<form action="recordQuote.pl">
<input type="text" name="quote" value="" />
<input type="submit" value="Submit" />
</form>
[download]

And then in recordQuote.pl...

#!/usr/bin/perl -wT

use strict;
use CGI;

my $q = new CGI;

my $quote = $q->param("quote");

open FILE, ">>rqhold.dat" or die "Can't open rqhold.dat: $!\n";
print FILE $quote, "\n";
close FILE;
[download]

That will take the user's input and append it to the file.

Phrack magazine has an excellent article on possible security bugs in CGI programs using open can have. Check it out.

Also, next time remember to enclose a block of code in <code> tags.

Fixed html entity dvergin 2002-03-09

Hey, thanks a lot for the help but i still got a bit of problems. On my form i put:

            <form action="http://TheRoyalKnights.com/cgi-bin/coranto/r
+qguest.cgi">
            <label>Blehhhh</label><input type="text" name="submitedquo
+te" size="40" /><br>
            <input type="hidden" value="index2.shtml" name="redirect">
+<input type="submit" value="submit" />
            </form>
[download]

Then on my Perl file i have:

#!/usr/bin/perl -wT

use strict;
use CGI;

my $q = new CGI;

my $quote = $q->param("submitedquote");

open FILE, ">>rqhold.dat" or die "Can't open rqhold.dat: $!\n";
print FILE $quote, "\n";
close FILE;
[download]

When i try to access rqguest.cgi i get an internal server error, and it's chmod'ed 755, so it must be an error in the script. What could it be? Thanks for your replies, and thanks in advance. -Xzyon

Without seeing the error output I can only think that its because you are using taint but are not then untainting the variables you read in. ie:

 # This var is not untainted
 my $quote = $q->param("submitedquote");
[download]

I'd also read Ovids tutorial. for more hints on CGI stuff.

Its also possible that you cannot open the file and your die statement has informed you of that. Take a look at your logs for more info.

You aren't outputting any headers - you either need to do so or send a response indicating that you aren't going to do so.

Update: see A CGI Program must make some output for more details

/J\