Jonathan17 has asked for the wisdom of the Perl Monks concerning the following question:

Hi, I've created a perl script to automate and log the process of adding and deleting users, and changing their passwords for certain directories, using .htaccess and .htpasswd files. This isn't really a question, as I only want your opinion. It works perfectly, for my needs.

Anyway, here's the source: http://www.pinetreenet.com/misc/Perl.txt

So, it's just a little script to manipulate permissions for given directories (just configure .htaccess files to point to the .htpasswd file the script edits), but I thought the input from you people, most of whom have likely used Perl much longer than I have, would be interesting. Note that the < and > sequences in the text are replaced by < and >, in my Perl. I just inserted those so it wouldn't make your browser choke, as it was mine. Thanks in advance for the feedback.
-Jonathan

Replies are listed 'Best First'.
Re: CGI DB interface
by sauoq (Abbot) on May 25, 2003 at 05:10 UTC

    Your code leaves a little to be desired...

    • The formatting is... well... almost non-existent.
    • You aren't using -w or use strict;.
    • You aren't taint checking.
    • You use the CGI module seemingly for one thing: printing out the header. (Why use CGI if you are going to parse the query string by hand?)
    • Your program starts with over 50 separate print statements. (Time to learn about here docs.)
    • Most of those 50 prints are writing out javascript...
    • Your error messages (e.g. open ... ||die("You suck");) aren't very informative.
    • Half the time you don't check the return from open at all.
    • WARNING! You have introduced a security hole and opened yourself to remote exploits by using tainted user supplied data inside backticks! This is no joke. If that code is up, anyone with access to it via the web can run arbitrary code on your server with the same privileges as the web server itself.

    My advice: don't walk... run and take that "code" off your server, delete it, read perldoc perlsec very very carefully, read perldoc CGI carefully, get yourself a copy of perltidy and learn how to use it, get a book on Perl and maybe one on CGI, educate yourself a bit, and then start with a less ambitious project.

    I know that's a little rough. I don't mean to be insulting; I just mean to tell it like it is. If you don't listen to the rest of my advice, at least listen to the part about taking that code off your server.

    -sauoq
    "My two cents aren't worth a dime.";
    
Re: CGI DB interface
by The Mad Hatter (Priest) on May 25, 2003 at 03:36 UTC
Re: CGI DB interface
by benn (Vicar) on May 25, 2003 at 14:56 UTC
    This is maybe a bit redundant if you've taken already taken heed of sauoq's sage advice, but if not, here's another completely un-biased opinion :).

    Take heed of sauoq's sage advice.

    Just to expand slightly on matters more 'stylistic'. sauoq's point about perltidy referred to your formatting - indentation etc. It may sound petty ("what the h*ll does it matter how *pretty* my code is so long as it works?") but a geat deal of coding is about stucture. Proper indentation, consistent brace styles and the like all help to make that structure more obvious. Forgive me if some conversion-to-html-then-txt destroyed your already-perfect indentation, but looking at the kind of redundancy etc. that I reckon you would have spotted had your code been 'easy on the eye', I doubt it.

    Another thing that makes code 'ugly' and hard-to-read is the mixing up of data and code, making it difficult to find specific parts of both. Here, your data is "print" statements containing (mainly) 'static' stuff. It's much more readable to have something like....

    if ($something) { print $big_long_something_response; } else { print $other_big_long_string }
    rather than...
    if ($something) { print "Something happened"; print "I could have defined this elsewhere in the file"; print "Or even used one of the fine templating modules..."; print "...available from a CPAN mirror near you..."; print "but instead I'm going to print 40 lines of code.."; print "and make this upcoming 'else' statement.."; print "really had to find without bracket bouncing all the time."; } else { print "you're going to have to bracket-bounce this one too.."; print "to skip what is basically a "do this or this" piece of code." +; . . }
    If you organised your code like this, you'd spot a lot of duplicated text ("This code copyright Pine Tree" etc.) that could be squirreled away (in "$copyright" for instance), making your intentions more obvious to yourself and others. In addition, the code would be easier to maintain, and you'd be more likely to spot structural errors /room for improvement.

    Cheers, Ben.

    A reply falls below the community's threshold of quality. You may see it by logging in.