in reply to CGI.pm ignore URL GET query string parameters

CGI should not mix POST and URL parameters. Quoting the CGI documentation:

Mixing post and url parameters

my $color = url_param('color');

[download]

It is possible for a script to receive CGI parameters in the URL as well as in the fill-out form by creating a form that POSTs to a URL containing a query string (a "?" mark followed by arguments). The param() method will always return the contents of the POSTed fill-out form, ignoring the URL's query string. To retrieve URL parameters, call the url_param() method. Use it in the same way as param(). The main difference is that it allows you to read the parameters, but not set them.

Under no circumstances will the contents of the URL query string interfere with similarly-named CGI parameters in POSTed forms. If you try to mix a URL query string with a form submitted with the GET method, the results will not be what you expect.

If running from the command line, url_param will not pick up any parameters given on the command line.

(Emphasis mine)

Alexander

--
Today I will gladly share my knowledge and experience, for there are no sweeter words than "I told you so". ;-)

Replies are listed 'Best First'.
Re^2: CGI.pm ignore URL GET query string parameters
by Danny (Chaplain) on Mar 13, 2024 at 20:09 UTC
    That all pertains to POST methods. If it's a POST the URL query string doesn't (unless $CGI::APPEND_QUERY_STRING is true) get into $cgi->param(), but if it's a GET it does. I'm asking if there is a way to keep GET parameters from populating $cgi->param(). I thought I remembered there being a pragma or something that allowed that, but I'm probably misremembering.
[reply]
[d/l]
[select]
      if there is a way to keep GET parameters from populating $cgi->param().

      Why? Check the result of request_method() first, then decide on how you want to handle parameters.

      Or, if you really insist on that strange behaviour, inherit from CGI and override param() and multi_param(). Something like this:

      package StrangeCGI;

# completely untested!

use strict;
use warnings;
use parent 'CGI';

sub multi_param
{
    my ($sself,@args)=@_;
    if ($self->request_method() ne 'POST') {
        return;
    } else {
        return $self->SUPER::multi_param(@args);
    }
}

sub param
{
    my ($sself,@args)=@_;
    if ($self->request_method() ne 'POST') {
        return;
    } else {
        return $self->SUPER::param(@args);
    }
}

1;

      [download]
      I thought I remembered there being a pragma or something that allowed that,

      I don't think that was ever possible.

      but I'm probably misremembering.

      You probably are.

      Alexander

      --
      Today I will gladly share my knowledge and experience, for there are no sweeter words than "I told you so". ;-)
[reply]
[d/l]
[select]
      I thought I remembered there being a pragma or something that allowed that, but I'm probably misremembering.

      Do you mean the invocation method defined at CGI.pm's Creating-a-new-query-object-from-an-input-file of CGI), which has the example:

      To create an empty query, initialize it from an empty string or hash: 
      my $empty_query = CGI->new("");
 
   -or-
 
my $empty_query = CGI->new({});

      [download]

      This creates your query object without any parameters from the get-go.

      Or, if you want to use the parameters at first so that you can extract information, but then delete them before outputting any HTML so they don't pre-populate forms, then you probably want to read Deleting-all-parameters of CGI to find $q->delete_all(); , which will delete the parameters at your whim.

[reply]
[d/l]
[select]
        "Do you mean the invocation method defined at CGI.pm's Creating-a-new-query-object-from-an-input-file of CGI)"
        No I was wondering about something like use CGI qw( -ignore_get_params ). If that existed it would be a simple way to ignore GET params without having to check $cgi->request_method().
[reply]
[d/l]
[select]

In Section Seekers of Perl Wisdom