Though it's not easy to find, the answer is here. I also have a brief overview of CGI security at my CGI course.

To summarize the problem with those particular environment variables, though: they change the way your shell behaves, so if you interact with the shell at all, you want your system's behavior to be predictable. However, read the link I provided and you'll have a good understanding of the basics.

Cheers,
Ovid

Join the Perlmonks Setiathome Group or just click on the the link and check out our stats.