Anonymous Monk has asked for the wisdom of the Perl Monks concerning the following question:

new to Perl and looking at some old script which uses cgi_handlers.pl module rather than the more industrial strength CGI.pm (having looked at Ovid's post)

Using this short script as an example:

http://www.iupui.edu/~webtrain/perl_script.html

What part(s) of the code is incompatible with CGI.pm?
edited by boo_radley : title change

  • Comment on porting a script from cgi_handlers.pl to CGI.pm (was : use CGI.pm)

Replies are listed 'Best First'.
•Re: use CGI.pm
by merlyn (Sage) on Mar 28, 2002 at 19:13 UTC
    What part(s) of the code is incompatible with CGI.pm?
    All of it, or none of it. Since it doesn't use CGI.pm, it's not "incompatible". {grin}

    Perhaps your real question is "what would that script look like if it had been written using CGI.pm rather than Yet Another Broken Handrolled Parser?" In that case, the answer is, "totally different". There are more things wrong with that script than right. For example, for the right string in the email parameter, I could execute an arbitrary command on that box.

    -- Randal L. Schwartz, Perl hacker

Re: use CGI.pm
by grep (Monsignor) on Mar 28, 2002 at 20:15 UTC

    OK... Here's some suggestions.

    #!/usr/local/bin/perl
    Turn on Taint checking, warnings and strict.
    #!/usr/local/bin/perl -wT use strict;


    for your header you can use the CGI.pm

    CHANGE
    &html_header("It's been sent");
    TO
    use CGI; my $q = new CGI; print $q->header;


    Not that it matters much in a script this small, but I would point you to Template Toolkit to seperate you markup from your code. Then you can replace all these print statments.

    print "<H2 ALIGN=center>It's been sent!</H2>; print "<HR ALIGN=center>"; print "<IMG SRC=\"http://www.iupui.edu/~webtrain/Graphics/Photos/b +ora_bora.jpg\>"; ...

    Here it looks like you're getting the query string. You can use CGI's param method.



    CHANGE
    @pairs = &url_decode(split(/[&]/, $request)); while ($pairs[$r]) { ($a,$b) = split(/[=]/,$pairs[$r++]); ($name = $b) if ($a eq 'name'); ($email = $b) if ($a eq 'email'); ...
    TO
    $q->param('name') $q->param('email') ...

    And as merlyn pointed out this is really bad

    open (MAIL, "|  mailx -s \"Web mail from $email!\" cholling\@iupui.edu");

    but when you turn on Taint checking this will not be allowed. This does not mean Taint checking is the be all, end all, you can unsafely untaint data. I would highly recommend Ovid Web programming with Perl course.

    grep
    grep> cd /pub
    grep> more beer

Re: porting a script from cgi_handlers.pl to CGI.pm (was : use CGI.pm)
by gellyfish (Monsignor) on Mar 29, 2002 at 11:46 UTC

    Hey, it's a holiday - this is a semi-mechanical conversion to CGI.pm :

    #!/usr/local/bin/perl -wT use strict; use CGI qw(:standard); use CGI::Carp qw(fatalsToBrowser); print header(), start_html( -title => "It's been sent"); print <<EOHTML; <H2 ALIGN=center>It's been sent!</H2> <HR ALIGN=center> <IMG SRC="http://www.iupui.edu/~webtrain/Graphics/Photos/bora_bora.jpg +"> <HR ALIGN=center> <H2 ALIGN=center>Thanks!</H2> <A HREF="http://www.iupui.edu/~webtrain/home.html">Back to Cindy's hom +e page </A> EOHTML my $name = param('name'); my $email = param('email'); my $status = param('status'); my $entry = param('entry'); my $cindy = param('cindy'); my $talk = param('talk'); my $surf = param('surf'); my $url = param('url'); my $whaturl = param('whaturl'); my $suggestion = param('suggestion'); my $explain = param('explain'); open (MAIL, qq%| mailx -s "Web mail!" cholling\@iupui.edu%) || die "Couldn't send mail - $!\n"; print MAIL <<EOMAIL; Sender: $name Email address: $email Status: $status, $explain Type of Message: $entry How Did You Find Me: $cindy $talk $surf $url If URL, what URL? $whaturl Message: $suggestion EOMAIL print end_html();
    Hope that helps.

    Update: Removed $email from the subject line passed to mailx as this is a security risk.

    /J\