my $rpt_id = $CGI->param('rpt_id');

# trim any leading or trailing whitespace
$rpt_id =~ s/^\s*//;
$rpt_id =~ s/\s*$//;

# assuming report id is suppose to only contain digits
unless ($rpt_id =~ /^\d+$/) {
    # handle error - id contains more than digits
}
[download]

#!/usr/local/bin/perl5_8 -T
[download]

my $rpt_tmpl = "cnc1_rpt" . $rpt_id . "_summary.tmpl";

# another way to achieve the same result:
my $rpt_tmpl = "cnc1_rpt@{[$rpt_id]}_summary.tmpl";

# and yet anther way
my $rpt_tmpl = sprintf("cnc1_rpt%d_summary.tmpl", $rpt_id);
[download]

my $file = $CGI->param('file');
open FH, '<', "$PATH/$file";
[download]

L-LL-L--L-LL-L--L-LL-L--
-R--R-RR-R--R-RR-R--R-RR
B--B--B--B--B--B--B--B--
H---H---H---H---H---H---
(the triplet paradiddle with high-hat)

I see what you mean by error checking first. As it turns out, the $rpt_id variable is actually set by the value of the radio button that is clicked; the user doesn't actually do anything but click on the radio button to indicate which report they want.

I am especially appreciative of your help/comments/suggestions about how to improve my code with regards to security. This is a big concern to me since I'm new at this. I've already received an agreement from our dba's to review my code for security holes after I get my initial draft completed, but it's nice to get the holes filled before showing it to them!

Thanks!

Lori

"... the user doesn't actually do anything but click on the radio button to indicate which report they want.

Even though you "narrow the choices" on the interface, the user doesn't have to use the interface. Instead they could submit a GET query directly:

# contrived example
http://foo.com/cgi-bin/form.cgi?rpt_id=../../../etc/password
[download]

or use a web bot, etc. Even though 99% of the people don't know about this, the 1% that does is 100% of the devious people you need to worry about. ;)
Cheers :)

jeffa

L-LL-L--L-LL-L--L-LL-L--
-R--R-RR-R--R-RR-R--R-RR
B--B--B--B--B--B--B--B--
H---H---H---H---H---H---
(the triplet paradiddle with high-hat)

Keep in mind that just because you have radio buttons laid out with specific id numbers doesn't mean the user has to actually use those; there's nothing preventing them from manually setting rcpt_id to "/etc/passwd", for example. In short, never, ever trust user input; always check it as shown above.