Jesse Smith has asked for the wisdom of the Perl Monks concerning the following question:

How do you use a perl script to empty a text file and then replace it with data from a web form? Here I first get the data from the file, then I use the web form to update it. The delete old data part works, but the new data doesn't get added to the file. $FORM{'content2'} doesn't get registered when editing it. 
#!/usr/bin/perl
###################

use CGI ':standard';
use CGI qw(:standard);  # then only CGI.pm defines a head()

$page = param('page');
#/cgi-bin/edit.cgi?page=edit

print header();
if ($page eq 'edit') {

#This part creates a form with the content from the edit.shtml file.
use LWP::Simple;
$content = get ('http://www.domain.com/edit.shtml');
print <<EOM;
<title>Test</title>
<meta http-equiv="Cache-Control" content="no-cache, no-store, must-rev
+alidate">
<META HTTP-EQUIV="Expires" CONTENT="-1">
<HTTP-EQUIV="PRAGMA" CONTENT="NO-CACHE">
<FORM METHOD=POST ACTION="http://www.domain.com/cgi-bin/edit.cgi" name
+="myForm">
<textarea title="Content (optional)" name="content2" cols="100" rows="
+50">$content</textarea>
<BR><input type="submit" value="SUBMIT"/></form>
EOM
}
else {

$database = "/home/site139/public_html/edit.shtml";

# Get the input
read(STDIN, $buffer, $ENV{'CONTENT_LENGTH'});

# Split the name-value pairs
@pairs = split(/&/, $buffer);

foreach $pair (@pairs) {
   ($name, $value) = split(/=/, $pair);

   $value =~ tr/+/ /;
   $value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C", hex($1))/eg;
   $FORM{$name} = $value;
}

{
#Here I delete the edit.shtml page.
open my $empty_the_file, "> /home/site139/public_html/edit.shtml" or d
+ie "Can not write file:
edit.shtml $!" ;
close $empty_the_file;

#Here I try to put in the data from the form but $FORM{'content2'} doe
+sn't get registered.

    open (DATABASE,">>$database");
    print DATABASE "$FORM{'content2'}\n";
    close(DATABASE);
}
print <<EOM;
<HTTP-EQUIV="PRAGMA" CONTENT="NO-CACHE">
Page edited.
<P>
$FORM{'content2'}
EOM
   exit;
}

[download]
  • Comment on Use a perl script to empty a file and then replace it with data from a web form
  • Download Code

Replies are listed 'Best First'.
Re: Use a perl script to empty a file and then replace it with data from a web form
by haukex (Archbishop) on Dec 05, 2017 at 06:31 UTC

    In addition to what the others have said - Use strict and warnings and don't use that $FORM code - you are exposing yourself to a huge security hole by allowing people to entirely replace an HTML file (with SSIs apparently). It's called a Cross-site scripting (XSS) attack, here's a tutorial (in fact, this is even worse, since you're allowing the page to be entirely replaced, not just portions of it).

    Although I really think you should move away from CGI.pm (CGI Parameters, UP-TO-DATE Comparison of CGI Alternatives, and CGI::Alternatives), and you need to address the above security issue somehow (at the very least some password protection?), to answer your questions: Instead of your $FORM stuff, use the param function, and to overwrite a file, you just need to use a regular open with a mode of ">" instead of ">>", this will clobber the file contents.

[reply]
[d/l]
[select]
Re: Use a perl script to empty a file and then replace it with data from a web form
by 1nickt (Canon) on Dec 05, 2017 at 03:33 UTC

    Hi, Perl comes with built-in safety features. Always, always:

    • use strict;
    • use warnings;
    • check the return value of open calls: 
            open (my $FILEHANDLE, '>>', $file) or die "Died: cannot open $fi
+le: $!";

      [download]


    The way forward always starts with a minimal test.
[reply]
[d/l]
[select]
Re: Use a perl script to empty a file and then replace it with data from a web form
by Anonymous Monk on Dec 05, 2017 at 03:40 UTC
[reply]
[d/l]
[select]

Back to Seekers of Perl Wisdom