The basic steps are as follows:

• Read form data
• Untaint this data (see perlsec)
• open and then flock a lockfile.
• open the log file and write the data to it.

The reason for the lockfile is simple: you can't flock a file until it's opened, but by then something else might already have opened that file and done something to it. Two programs trying to access your log at the same time (say, one for reading and one for writing) could cause data corruption or a race condition. By using a lock file, you have a file that can safely be opened and flocked without worrying about whether or not it's going to get corrupted.

#!/usr/bin/perl -wT
use strict;
use Fcntl qw/:flock/;
use CGI   qw/:standard/;

my $log      = 'somelog.log';
my $lockfile = "$log.lock";

# grab form data
my $_name  = param( 'name' );
my $_email = param( 'email' );

# untaint form data
my ( $name )  = ( $_name =~ /^([\w.',]{1,30})$/ )
    or some_error_routine( $_name );

# I *hate* dot-star untainting, but virtually any character
# is valid in an email address.
my ( $email ) = ( $_email =~ /^(.{1,500})$/ )
    or some_error_routine( $_name );

# We're getting rid of ASCII zero as this is the delimiter
# in the file we're writing to.
$email =~ s/\0//g;

open LOCK, "> $lockfile" or die "Cannot open $lockfile: $!";
flock LOCK, LOCK_EX      or die "Cannot flock $lockfile: $!";

open LOG, ">> $log"      or die "Can't open $log for appending: $!";
print LOG "$name\0$email\n";
close LOG;
close LOCK;

# output some response here
[download]

Note that the above code is incomplete and untested. Further, I have limited the length of the $name and $email variables. This is done to ensure that someone doesn't try to enter unreasonably large values for this data.

Cheers,
Ovid

Vote for paco!

Join the Perlmonks Setiathome Group or just click on the the link and check out our stats.

---

---

Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!

Titles consisting of a single word are discouraged, and in most cases are disallowed outright.

Read Where should I post X? if you're not absolutely sure you're posting in the right place.

Please read these before you post! —

• How do I compose an effective node title?
• How do I post a question effectively?
• Markup in the Monastery

Posts may use any of the Perl Monks Approved HTML tags:

a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr

You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)

	For:		Use:
	&		&
	<		&lt;
	>		&gt;
	[		&#91;
	]		&#93;

Link using PerlMonks shortcuts! What shortcuts can I use for linking?

See Writeup Formatting Tips and other pages linked from there for more info.