You know, one of the things I took from the most obvious writings about Perl in its early days was the philosophy that you don't have to "know all about it" in order to get things done with Perl. It is not considered necessary to rise to some high level of mastery before starting. It is meet to restrain oneself from certain courses of action when there is the risk of damage or extreme annoyance as a result of your programming efforts.

This is true of Perl. But we're not just talking about Perl. We're talking about CGI. The problems that merlyn is talking about have nothing to do with Perl, they are all about CGI. They would be the same in any language that you chose to implement your CGI program.

From a security point of view, putting a CGI program on a public web server is one of the most dangerous things you can do. You do need to understand all the security implications. Writing a Perl program is easy. You don't need to know how everything works in order to get your program running. But writing a CGI program is a completely different ball game. I really don't understand why there are so many books written that encourage people with no experience in programming to write CGI programs. It's a recipe for disaster.

--
<http://www.dave.org.uk>

"The first rule of Perl club is you do not talk about Perl club."
-- Chip Salzenberg