After looking over your code, I've made a few changes that should help it a bit. I have not changed any of the functionality, but instead have made it a bit more secure and cleaned up some of the code.

After giving it a bit of thought, I went ahead and converted most of your raw HTML to the CGI equivalent. Ordinarily, I wouldn't do this to anyone else's script, but I noticed you were doing it partway and figured you wouldn't mind my finishing the job, so to speak.

If you'd like to learn more about CGI scripting, you can check out my online Web programming course. It currently only has two lessons and one appendix, but I'm working on lesson 3, which is a brief overview of CGI scripting security. Hopefully I'll have it up in just a couple of days.

#!/usr/bin/perl -wT
use strict;
use CGI;

# We use this to prevent someone from inserting HTML tags.
# Otherwise, they can include pornographic images, server
# side includes, or a meta refresh tags!
use HTML::Entities;

my @text;

# By defining the separator here and not hardcoding it in the script,
# we can make it much easier to change in the future!
my $separator = "::";
my $query     = new CGI;

print $query->header,
      $query->start_html(-title => "Guestbook Thing"),
      $query->h1("Guestbook Thing");

writeit();
readit();
printit();

print $query->end_html;

sub writeit{
    my($query)=@_;
    print $query->startform;
    print "Name:",
          $query->textfield( -name => 'Name' ),
          $query->br(),
          "Message:<BR>", 
          $query->textarea( -name    => "Comments",
                            -rows    => "10",
                            -columns => "50" ), 
          $query->br(),
          $query->submit( -value => "Submit"),
          $query->reset( -value => "Reset" ),
          $query->hr(),
          $query->endform;

    my $name     = $query->param('Name');
    my $comments = $query->param('Comments');

    # We're going to eliminate newlines so each comment is on one line
    $comments    =~ s/\n/<br>/g;
    chomp ( $name     = encode_entities( $name ) );
    chomp ( $comments = encode_entities( $comments ) );

    # Oops!  We need to get the <br> back!
    $comments    =~ s/&lt;br&gt;/<br>/g;
    if ( defined $name and defined $comments ) {
        open(WRITE,">>guestbook.txt") || dienice("AHH $!");
        print WRITE ( join $separator, ( $name, $comments ) ) . "\n";
        close(WRITE) || dienice("AHH $!");
    }
}

sub readit{
    open(WRITE,"guestbook.txt") || dienice("AHH $!");
    @text = <WRITE>;
    chomp @text;
    close(WRITE);
}

sub printit{
    print $query->h2('Current Results');
    foreach ( @text ) {
        my ( $name, $message ) = split /$separator/, $_;
        print $query->hr,
              "Message By: $name",
              $query->br,
              "&lt;Message&gt;: ",
              $query->br,
              $query->blockquote( $message ),
              "&lt;/Message&gt;";
    }
}
[download]

Other ideas:

• Add timestamps for messages.
• Add threading (yes, that's quite a project)
• Give the users proprietary formatting tags.
• Allow only a subset of HTML. This one is tough, but you can check out this node for a start, if you want to try to work through the regular expression.

Good luck!

Cheers,
Ovid

Join the Perlmonks Setiathome Group or just go the the link and check out our stats.

---

---

Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!

Titles consisting of a single word are discouraged, and in most cases are disallowed outright.

Read Where should I post X? if you're not absolutely sure you're posting in the right place.

Please read these before you post! —

• How do I compose an effective node title?
• How do I post a question effectively?
• Markup in the Monastery

Posts may use any of the Perl Monks Approved HTML tags:

a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr

You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)

	For:		Use:
	&		&
	<		&lt;
	>		&gt;
	[		&#91;
	]		&#93;

Link using PerlMonks shortcuts! What shortcuts can I use for linking?

See Writeup Formatting Tips and other pages linked from there for more info.