I don't know if you meant that as a joke or not. There were 1.8 million documents returned by that search!

So are you saying that before someone writes a CGI script that sends mail, they should start by reading 1.8 million web documents as a prerequisite?

You know, one of the things I took from the most obvious writings about Perl in its early days was the philosophy that you don't have to "know all about it" in order to get things done with Perl. It is not considered necessary to rise to some high level of mastery before starting. It is meet to restrain oneself from certain courses of action when there is the risk of damage or extreme annoyance as a result of your programming efforts.

But in this case, I feel that the danger is significantly overstated. The chance of a major spam offender finding some sleepy website with a homemade "tell your friends script" and coercing that to further pollute the world at top speed seems remote to me. (No offense iamrobj, I haven't actually looked at your web site, I'm making a guess here.)

To answer your question further on in the thread iamrobj, it's not too hard to "sanitize" your script. One simple discussion in the Perl Cookbook (recipe 19.4 "Writing a Safe CGI Program) can get you on your way. Just be sure to test the data that is submitted for any message headers for illegal characters, and if you want to be very diligent, maybe you could read up on how to have your script probe the From: address to see if it truly exists.

In the end, don't let discouragement from others freeze you into inactivity. Just let it serve as a warning that you may need to be careful about certain things, because it is true that putting up a CGI script allows others to utilize your computing facility. (or that of your ISP) So think everything through and ask around about potential risks. But definitely keep on coding!

...All the world looks like -well- all the world, when your hammer is Perl.
---v

You know, one of the things I took from the most obvious writings about Perl in its early days was the philosophy that you don't have to "know all about it" in order to get things done with Perl. It is not considered necessary to rise to some high level of mastery before starting. It is meet to restrain oneself from certain courses of action when there is the risk of damage or extreme annoyance as a result of your programming efforts.

This is true of Perl. But we're not just talking about Perl. We're talking about CGI. The problems that merlyn is talking about have nothing to do with Perl, they are all about CGI. They would be the same in any language that you chose to implement your CGI program.

From a security point of view, putting a CGI program on a public web server is one of the most dangerous things you can do. You do need to understand all the security implications. Writing a Perl program is easy. You don't need to know how everything works in order to get your program running. But writing a CGI program is a completely different ball game. I really don't understand why there are so many books written that encourage people with no experience in programming to write CGI programs. It's a recipe for disaster.

--
<http://www.dave.org.uk>

"The first rule of Perl club is you do not talk about Perl club."
-- Chip Salzenberg

First, I don't want you putting code like that on your system at all. Why would you want to add to the mail burden many of us already receive? It's simple enough to just suggest to someone that they might want to tell their friends about your site. Don't make it easier than that.

Second, with the errors you've made, I feel I would just be playing a game of "whack-a-mole". I'd help you fix one error, and you'd introduce two more in the next edit. I'm not willing to waste my time like that, nor give you the illusion that you can get by with just a little bit of knowledge. A little knowledge is a dangerous thing. Read the FAQs I pointed to earlier. Learn on your own. You'll quickly see what I saw, and then you won't need me any more.

-- Randal L. Schwartz, Perl hacker
Be sure to read my standard disclaimer if this is a reply.