You should always use Taint checking when dealing with CGI scripts or scripts that interact with the server. Plus, its just a good habit to get into anyway. Taint checking doesn't allow any information from outside of the Perl program (parameters, ENV vars, etc) to be used in certain functions or in system calls. Example: This will die under -T:
#!/usr/bin/perl -wT
my $paco = shift; # get first argument from @ARGV, or the command line
+.
unlink $paco;

[download]
After running this, even without anything in @ARGV, it will give you an error like: 
Insecure dependency in unlink while running with -T switch at test.pl 
+line 3

[download]
Now that you (partially) understand taint checking, always be sure to add warnings as well. You do this by just adding the -w flag to your shebang like so: 
#!/usr/bin/perl -wT

[download]
Now that script has warnings and taint checking activated.

What warnings does is make it easier to debug your program. If you are above 5.006 then you can just add use warnings; to your script.

Ok, now, another problem with your script is taht you dont use strict;. There are many articles on it, so here are some perllib and strict.pm.

Another problem with your script is that you don't check to see if your program opened up one of the many files correctly. You also don't check to see if they close correctly. You can help yourself and your program by adding this to your open and close calls:
open(FILE,$file) || die "Could not open $file because: $!";
close(FILE) || die "Could not close $file because: $!";

[download]
This way it will check to see if they did what they were supposed to do and save you some problems later. 

$_.=($=+(6<<1));print(chr(my$a=$_));$^H=$_+$_;$_=$^H;
print chr($_-39); # Easy but its ok.

[download]

In reply to Re: securing code by damian1301
in thread securing code by marcs

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.