in reply to Text formatting a command in CGI
Update Oops, didn't see the system call was multi-arg. I should probably get some sleep. ; )
system won't return the text that is spit out onto STDOUT by the program it calls. You should use backticks for that, but the problem with backticks is security holes. As for formatting, just use the pre HTML tag to keep the formatting...
BUT, you shouldn't be doing any of that, because the person running it could put anything in $ip. You haven't provided other code, so I don't know if you do filtering and escaping, but even then I wouldn't do something like that. It is almost a guaranteed security hole. What if I set $ip to "; rm -rf /"? It would run
as whatever user the CGI is running as.
|
|---|
| Replies are listed 'Best First'. | |
|---|---|
|
Re: Re: Text formatting a command in CGI
by digitalx (Novice) on May 24, 2003 at 02:38 UTC | |
by merlyn (Sage) on May 24, 2003 at 05:01 UTC | |
by digitalx (Novice) on May 24, 2003 at 02:58 UTC | |
|
Re: Re: Text formatting a command in CGI
by digitalx (Novice) on May 27, 2003 at 04:38 UTC |