I tried your example just to see what happens, but i can't find any strange behaviour.
The code passes my whole script as a string without beeing executed. In the end it appears as a post on the message-board without any changes.
I think the point is, that i use single-' characters. So no execution is performed.
But i have to admit:
In the current version it is possible to manipulate the execution by combinations of ' and \ chars or if \ is the last character at all. In this case, the evaluated string will look like this: 'foo\\'bar' or like this: 'foo\';.
In the first case 'bar' will be executed, if it contains perl-code. (I tried this one 6\'+7+\'3. so the evaluated string is '6\\'+7+\\'3'. The result was - as expected - '16').
To avoid this, i sometimes have to protect some \-characters by doubeling them, or simply remove every \-char followed by a '-char...
In reply to Re^9: CGI-Upload / Bad File Number
by frnk
in thread CGI-Upload / Bad File Number
by frnk
| For: | Use: | ||
| & | & | ||
| < | < | ||
| > | > | ||
| [ | [ | ||
| ] | ] |