Hello, recently I recieved a lot of mocking for my 'unsafe' mailform combined with some poor CGI script. Now I am doing some experiments and excercises figuring out what is secure content, and the so-called 'injections'. I`ve put a very basic module free code performing very simple tasks so I need some revisions, and if it`s the right way.
#!/usr/bin/perl -wT use strict; use utf8; sub pass_env { my (@pass1) = split("&", $_[0]); my ($pass2) = join("=", @pass1); my (%pass3) = split("=", $pass2); return %pass3; } sub check_mail { #use Email::Valid instead if ( (my @valid = split("@", $_[0]) )== 2 ) { #continue with regex later... return 1; } else { return 0; } } sub check_vars { #use htmlspecialchars() based check foreach (@_) { if ( /[><;():]+/ ) { return 0; } } return 1; } ## my $str = "sub=hello&mail=sometext&text=beeee mooo "; # $ENV{'QUERY_ST +RING} simulation my %hash = &pass_env($str); if ( &check_vars($hash{'sub'}, $hash{'mail'}, $hash{'text'})) { if ( &check_mail($hash{'mail'}) ) { print $hash{'sub'},"\n"; print $hash{'mail'}, "\n"; print $hash{'text'}, "\n"; } else { print "Invalid email.\n"; } } else { print "Please, fill all forms.\n"; }
so I need some opinions good or bad, no matter.
In reply to Is that a decent concept? by heatblazer
| For: | Use: | ||
| & | & | ||
| < | < | ||
| > | > | ||
| [ | [ | ||
| ] | ] |