Yes, you'll have to use -T to enable taint checking. It cannot do your work for you, though. It is merely prevents you from accidentally using unfiltered user input to perform dangerous operations. The onus for defining what data is well-formed and safe to accept and what's not, though, is still on you.

The only way to get untainted data from a tainted variable is to perform a pattern match, and capture some or all of the data. The captured data is then untainted. F.ex, if you have an input value that must only consist of digits, you could untaint it like so:

unless( $some_user_input =~ /^(\d+)$/ ) {
    die "You did not pass only digits for some_input\n";
    # or you produce an error page here or send the user back if it's 
+a CGI, f.ex
}

my $untainted_user_input = $1;

[download]

Now you can perform dangerous operations using $untainted_user_input.

Of course, nothing stops you from using /(.*)/s as the test pattern, therefor accepting any input at all and thus defeating the point of taint checks.

Ovid's excellent CGI course has an enlightening chapter on how to untaint data sensibly, treating taint checking as an ally that will help you avoid getting exploited.

There are modules on CPAN that will help you with common untainting tasks — look for the various Untaint modules.

Makeshifts last the longest.

In reply to Re^3: Please explain this tainting behaviour by Aristotle
in thread Please explain this tainting behaviour by Anonymous Monk

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.