I'm just going to copy their horribly incorrect Listing 5:

#!/usr/bin/perl
        use CGI;

        my $var1 = CGI->new();
        my $parameter = $cgi->param('text');

        print $var1->header();
        print "parameter";
[download]

Where is $cgi ever defined? $var1 is the cgi object. How is this script vulnerable to scripting attacks? They print out the text 'parameter', not the variable $parameter. Someone really fudged things up here.

Their methods for 'filtering' input are just weird. Anyone who just throws s/[^A-Za-z0-9 ]*/ /g; to filter input is just being... stupid? Invalid data should not be filtered out, it should be outright rejected and the user should be reprompted for valid input.