in reply to A problem use CGI.pm

Please forgive me if I read your code wrong, Javascript isn't my first language. Couldn't you remove the Javascript and do this.

#!/usr/local/bin/perl -wT
use CGI qw(:standard);
use strict;

my $num = param('number');  #has to be numeric
my $let = param('lets'); #has to be letters
my $both = param('both'); #can be letter or number
die "Invalid datatype for num" if $num =~ /[^0-9]/;
die "Invalid datatype for let" if $let =~ /[^a-zA-Z]/;
die "Invalid datatype for both" if $both =~ /[^0-9a-zA-Z]/;
die "num can not be null" unless defined $num;
die "let can not be null" unless defined $let;
die "both can not be null" unless defined $both;

[download]

Many other security measures could be taken as well, I suggest you check out Ovid's Course in the Tutorials section for better examples.

"Pain is weakness leaving the body, I find myself in pain everyday" -me

Replies are listed 'Best First'.
Re: Re: A problem use CGI.pm
by lgjut (Initiate) on Oct 29, 2003 at 04:52 UTC
    Thank you for so kind reminder.
    The reason I use JavaScript is I want to check user input at client side. It can give user response immediately.
[reply]

      Many people surf with Javascript disabled.

      Thus, you'll have to verify the input server-side anyway.

      Why do it twice?

[reply]
        Thank you kutsu for that very simple and elegant solution (I'm learning to untaint user input this very moment and this is helpful).

        However, at the risk of being OT, menolly and other monks, I really do wonder what the percentage is of people who are surfing sans-javascript (JS). With the plethora of helpful pop-up windows, DHTML menus and other tricks, how is this possible? What about Flash? I have a personal aversion to sites that are only Flash and usually skip them. How much am I missing?

        Secondly, do we webbies code for non-JS surfers? Or is this akin to coding web-safe colors, 640x480 monitors, and Netscape 4.7?

        Lastly, even though we need to validate on the server-side, JS on the client side can validate input and return an error so much faster than the Perl which has to refresh the screen each time.

        It is the dilema I'm facing now as I learn to code Perl accurately and securely, and not miss out on all the fun of JS and DHTML brings the pure designer (who is avoiding Flash). Let the debate rage!

[reply]

In Section Seekers of Perl Wisdom