in reply to file upload
Using directly $filename, from the CGI param(), in open() is insecure as someone could overwrite your system files by uploading files named "../../../var/www/html/index.html" for example. It is wiser to use a temporary filename and never trust the filename from param().open OUTFILE, "> /tmp/test_upload" or die "error: $!";
|
---|