comment on

Another few problems:

How big is FILE? Why are you reading it completely into RAM before using it?
Fix: Iterate over FILE in a while-loop.
Are you sure you reading it completely before someone else modifies it? Why aren't you flock'ing the filehandle? You are running in an environment where the same script could be trying to open the same file more than once and /or another script potentially could be changing the file at the same time.
Fix: Use flock.
Are you checking for file existence first? What about if the path is a directory?
Fix: Use -d and -e (and -f, potentially)
Are your pathnames relative to server root? What happens if your user specifies '/etc/passwd' or '/proc/cpuinfo' or some other file they really shouldn't be touching?
Fix: Don't allow your user to specify a filename. Make them choose from a list, then verify they actually chose from that list.

Alternatives to your fixes above:

You correctly specify the open() fixes for Perls greater than 5.005_03 (when 3-arg open was introduced). sysopen() is always a fix for security holes. perlopentut has the details.
You're right in that you don't need double-quotes and that does skirt the immediate issue. However, the correct solution is to force your user to pick from a list of acceptable files and make sure they picked from it. (q.v. problems list above.) won't work as expected ...

Being right, does not endow the right to be rude; politeness costs nothing.
Being unknowing, is not the same as being stupid.
Expressing a contrary opinion, whether to the individual or the group, is more often a sign of deeper thought than of cantankerous belligerence.
Do not mistake your goals as the only goals; your opinion as the only opinion; your confidence as correctness. Saying you know better is not the same as explaining you know better.

In reply to Re: Bad code from the trenches by dragonchild
in thread Bad code from the trenches by Whitehawke

Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!

Titles consisting of a single word are discouraged, and in most cases are disallowed outright.

Read Where should I post X? if you're not absolutely sure you're posting in the right place.

Please read these before you post! —

Posts may use any of the Perl Monks Approved HTML tags:

a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr

You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)

	For:		Use:
	&		`&`
	<		`<`
	>		`>`
	[		`[`
	]		`]`

Link using PerlMonks shortcuts! What shortcuts can I use for linking?

See Writeup Formatting Tips and other pages linked from there for more info.