in reply to Help! Form in a File!!

Phrack magazine has an excellent article on possible security bugs in CGI programs using open can have. Check it out.

Also, next time remember to enclose a block of code in <code> tags.

Cheers,
Erik

Fixed html entity dvergin 2002-03-09

Replies are listed 'Best First'.
Re: Re: Help! Form in a File!!
by Anonymous Monk on Mar 10, 2002 at 00:06 UTC
    Hey, thanks a lot for the help but i still got a bit of problems. On my form i put:
    <form action="http://TheRoyalKnights.com/cgi-bin/coranto/r +qguest.cgi"> <label>Blehhhh</label><input type="text" name="submitedquo +te" size="40" /><br> <input type="hidden" value="index2.shtml" name="redirect"> +<input type="submit" value="submit" /> </form>
    Then on my Perl file i have:
    #!/usr/bin/perl -wT use strict; use CGI; my $q = new CGI; my $quote = $q->param("submitedquote"); open FILE, ">>rqhold.dat" or die "Can't open rqhold.dat: $!\n"; print FILE $quote, "\n"; close FILE;
    When i try to access rqguest.cgi i get an internal server error, and it's chmod'ed 755, so it must be an error in the script. What could it be? Thanks for your replies, and thanks in advance. -Xzyon
      Without seeing the error output I can only think that its because you are using taint but are not then untainting the variables you read in. ie:
      # This var is not untainted my $quote = $q->param("submitedquote");
      I'd also read Ovids tutorial. for more hints on CGI stuff.

      Its also possible that you cannot open the file and your die statement has informed you of that. Take a look at your logs for more info.

      You aren't outputting any headers - you either need to do so or send a response indicating that you aren't going to do so.

      Update: see A CGI Program must make some output for more details

      /J\

        Hey, thanks a lot for the help, but...
        I'm a real newbie on perl.
        So, i don't know all this stuff yet.
        you talked in PHP there for me. (and i don't know PHP) ;)
        little more help plz :-D
        Thanks in Advance,
        -Xzyon