In reading over the node, Executing a function on submit, I realized that one of my coding practices has some potential security risks.

Instead of retrieving the value of parameter values on an as-needed basis, I quite typically dump the entire contents of param() to scalars, as in: 

use strict;
use warnings;
use CGI;
my $q = new CGI;
@names = $q->param;
foreach $name(@names){
    $$name=$q->param($name);
    #print $name, ': ', $$name, '<BR>';
}

[download]
So any form field in the HTML file automatically becomes a Perl var in the cgi script when the form is submitted.

After spending some time on this site, it occurs to me that some unscrupulous but savvy user could quite easily break a program by "hijacking" my form, i.e. downloading a local copy and modifying the field names in the form and changing the ACTION statement to a fully qualified URI.

How ruined would my day be if the following were submitted?: 

<FORM METHOD=POST ACTION="http://mydomain.com/cgi-bin/search.cgi">
<INPUT TYPE='text' name='a'>
<INPUT TYPE='text' name='b'>
<INPUT TYPE='text' name='/'>
<INPUT TYPE='text' name='\'>
<INPUT TYPE='text' name='!'>
<INPUT TYPE='text' name='_'>
</FORM>

[download]
I understand that a lot depends on the particulars of my script, but my generalized question is is my concern warranted or is there some sort of built in security measure in CGI.pm to handle reserved variable names? If my concern is warranted, has anyone out there come up with a bullet proof way of dealing with this?

I've read over the CGI docs and can't find anything related to this topic. (??)

In reply to Web form security by earthboundmisfit

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.