in reply to cgi_handlers.pl

Assuming that we're referring to the same code, you do not want to to use cgi_handlers.pl. Here's the relevant code section (comments removed):

sub get_request { if ($ENV{'REQUEST_METHOD'} eq "POST") { read(STDIN, $request, $ENV{'CONTENT_LENGTH'}); } elsif ($ENV{'REQUEST_METHOD'} eq "GET" ) { $request = $ENV{'QUERY_STRING'}; } %rqpairs = &url_decode(split(/[&=]/, $request)); } sub url_decode { foreach (@_) { tr/+/ /; s/%(..)/pack("c",hex($1))/ge; } @_; }

This code has virtually all of the bugs one is likely to find in most hand-rolled code, plus some extras.

There are a variety of other issues with this code, but this is a good start. See use CGI or die; for more information.

Cheers,
Ovid

Join the Perlmonks Setiathome Group or just click on the the link and check out our stats.

Replies are listed 'Best First'.
Re: (Ovid) Re: cgi_handlers.pl
by Ven'Tatsu (Deacon) on Nov 06, 2001 at 03:46 UTC
    One more bug: It is perfectly valid (although I think it should be avoided) to pass information in the query string of a POST request.

      Nice catch. Yes, I think that qualifies as a bug but I didn't list it as there is a workaround: set $ENV{'REQUEST_METHOD'} to 'GET' and call get_request() again (after previously saving the contents of %rqpairs). This is a typical workaround for most faulty implementations, but it bugs me that most cgi handlers miss this.

      Cheers,
      Ovid

      Join the Perlmonks Setiathome Group or just click on the the link and check out our stats.