in reply to Re: Re: taint check that I thought worked
in thread taint check that I thought worked

In this case, I belive that \z and \Z would be equivalent, as \W chars (including \n's) are stripped just before the matching. Am I right?

Replies are listed 'Best First'.
Re: Re: Re: Re: taint check that I thought worked
by ysth (Canon) on Feb 03, 2004 at 16:06 UTC
    Yes; I had missed that part. So the function boils down to: 
    print "failure" and return 1 if contains _ or more than 16 alphanumeri
+cs
otherwise return alphanumerics.

    [download]
    I suspect the _ and return 1 parts are unintentional, and the function would be better as: 
    sub untaint_username
{
    my $tainted = shift;

    # remove non-alphanumerics
    $tainted =~ y/a-zA-Z0-9//cd;
    # or s/[\W_]//g

    # must be 1-16 characters
    return "$1" if $tainted =~ /\A(.{1,16})\z/;
    print "failure\n";
    return;
}

    [download]
[reply]
[d/l]
[select]

In Section Seekers of Perl Wisdom