in reply to reading CGI form data
Please make sure to read Mark-Jason Dominus' archived newsposts, part one, two and three on Why it's stupid to 'use a variable as a variable name'. You really don't want to do that.
If you automatically generate variables named after all the parameters in your code, you may end up only thinking you do so. What if someone saves the page with your <form>, edits it and sends a request that contains, f.ex, &/=& ? You will end up trampling over Perl's $/ variable and probably doing something you really didn't expect. (See perldoc perlvar to find out what that variable does..) And what if you have a variable called $filename that's not supposed to be changed from the outside and someone sends you a &filename=/etc/passwd?
Just don't go there.
What's wrong with saying param('uid') instead of $uid?
Makeshifts last the longest.
|
|---|