in reply to Web form security

Generally, symbolic references are not a good idea, especially when combined with names you get from outside! Also, I don't know how this is passing strict -- @names is undeclared, and if I'm not mistaken strict 'refs' disables symbolic references. Try instead using a hash (also added CGI functions rather than raw HTML, and string interpolation)...
use strict; use warnings; use CGI; my $q = CGI->new; my @names = $q->param; my %param; foreach my $name (@names) { $param{$name} = $q->param($name); print "$name: $param{$name}", $q->br; }
Or, more concisely:
use strict; use warnings; use CGI; my $q = CGI->new; my %params = map { $_, $q->param($_) } ($q->param); print join $q->br, map { "$_: $params{$_}" } ($q->param);

Replies are listed 'Best First'.
Re: Re: Web form security
by earthboundmisfit (Chaplain) on Jul 31, 2001 at 00:32 UTC
    Ok, you caught me. I wasn't using strict in my "real" script. Forgive me. I'm weak =)

    I'm still not 100% clear on what I should or should not be doing, but I understand a little better what's at stake. Thanks.

      A little more explanation:
      use strict; use warnings; use CGI;
      Use strict and -w, except of course for one-liners and/or short throwaway scripts. Note that the warnings pragma only works under Perl v5.6.0+.
      my $q = CGI->new; my @names = $q->param; my %param;
      This instantiates the CGI object and fills @names with the parameter list, then declares %param, to be used later.
      foreach my $name (@names)
      Iterating over each parameter in order,
      { $param{$name} = $q->param($name);
      Set the value in the parameter hash ($param{$name}) to the parameter value ($q->param($name))...
      print "$name: $param{$name}", $q->br; }
      ... and print it; the $name and $param{$name} values are interpolated into the string. $q->br just generates an empty BR tag.

      The other version:

      use strict; use warnings; use CGI; my $q = CGI->new;
      Same as before.
      my %params = map { $_, $q->param($_) } ($q->param);
      This simultaneously instantiates %params and fills it with, for each element in $q->param (the parameter list), the name ($_, the placeholder variable -- see map / perlvar) plus the value ($q->param($_)). When this is put into a hash these pairs turn into keys and values.
      print join $q->br, map { "$_: $params{$_}" } ($q->param);
      This first takes the parameter list ($q->param) and maps each element to the string "$_: $params{$_}" which is the name ($_) plus a colon, space, and value ($params{$_}) -- accessing an element of the params hash with key being the name. Then it joins these strings together with the empty BR tag, and prints the result. Hope this helps.