Well the problem with the original code is obvious. The open invokes a subshell, which means that a shell reads the code. What happens if the subshell includes something like this: 
' `rm -rf /`

[download]
Then the subshell would cheerfully try to produce two arguments for the child, with the second subshell being the output of...oops. :-)

As for the second example that they give. In open they say that opening "-|" or "|-" does an implicit fork with the parent process getting the pid of the child, and the child getting 0. So if you try to do that and get an undefined pid, well something went wrong. And if you did that and got a true pid, then you are the parent. But if you did that and got 0 then you are the child and need to do something else. Like call exec to become someone else without using the shell.

Of course all of this is rather verbose and complicated. It is far simpler to accomplish the task using IPC::Open2 or IPC::Open3. Here is (tested code) with IPC::Open3: 

use IPC::Open3;
# Time passes.

my $pid = open3("<&STDIN", \*PIPE, ">&STDERR", $figlet, $str)
  or die "Cannot run '$figlet' with argument '$str': $!";
print <PIPE>;  # Whatever you want here

[download]
I have seen IPC::Open3 work on Windows with 5.005, so this snippet is probably pretty portable.

Oh, you may want to glance at wait and waitpid if you are concerned about the possibility of creating zombies. That happens when the child dies and is left in a state where the process exists and cannot finish expiring until it tells you how it died. But you, the thoughtless parent, are refusing to listen and so keep it on in a strange half-life... :-)

In reply to Re (tilly) 1: CGI Security and Forking by tilly
in thread CGI Security and Forking by Ovid

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.