But any remotely hubristic programmer will of course write this:my ($foo, $bar, $baz, $quux); defined && /^([[:alpha:]]+)$/ ? $foo = $1 : taint_fail('foo') for scal +ar param('foo'); defined && /^([[:alpha:]]+)$/ ? $bar = $1 : taint_fail('bar') for scal +ar param('bar'); defined && /^([[:alpha:]]+)$/ ? $baz = $1 : taint_fail('baz') for scal +ar param('baz'); defined && /^([[:alpha:]]+)$/ ? $quux = $1 : taint_fail('quux') for sc +alar param('quux');
my %check = ( foo => qr/^([[:alpha:]]+)$/, bar => qr/^([[:alpha:]]+)$/, baz => qr/^([[:alpha:]]+)$/, quux => qr/^([[:alpha:]]+)$/, ); my %f; for my $pname (keys %check) {; defined && /$check{$pname}/ ? $f{$pname} = $1 : untaint_fail($pnam +e) for scalar param($pname); }
This will call untaint_fail only when the regex failed, and preserve undef vs empty string where they're valid input.
Update: Oops. The code would previously leave things tainted since it was assigning $1 back to the tainted variable. Shifting things around minorly fixed that.
Makeshifts last the longest.
In reply to Re: "Correct" program style questions
by Aristotle
in thread "Correct" program style questions
by Ovid
| For: | Use: | ||
| & | & | ||
| < | < | ||
| > | > | ||
| [ | [ | ||
| ] | ] |