in reply to •Re: incorrect use of URI::Escape?
in thread incorrect use of URI::Escape?

Hi merlyn

I am not a great fan of URI::Escape because (as is noted in the pod) it is much slower than rolling your own (40-700% says the pod) and also has the ability to be called in a dangerous way. eval() always scares me in code because of what you can do if you pass an appropriate value into it. Worse as it is open source you can see just how to do it.

use URI::Escape; uri_escape(1,'hacker])//; warn "Running arbitrary code!"; s/([hacker') +;

I don't quite see how calling $values->{$_} could return a list but....

cheers

tachyon

s&&rsenoyhcatreve&&&s&n.+t&"$'$`$\"$\&"&ee&&y&srve&&d&&print