This will give you access to params without having to know if they came in on a post or a get and without having to monkey around with environment variables.

As for your code snipit:

foreach $thing (keys(%INPUT)) {
        if(ref($INPUT{$thing}) eq "ARRAY") { $INPUT{$thing} = join('^'
+, $$INPUT{$thing}); }
#       if($#INPUT{$thing}) { $INPUT{$thing} = join('^', $$INPUT{$thin
+g}); }
}
[download]

foreach $thing ( keys %INPUT ) 
{
    if( ref( $INPUT{$thing} ) eq "ARRAY" ) 
    { 
        $INPUT{$thing} = join '^', @{$INPUT{$thing}}
    }
}

# You can also write the above like this:
$INPUT{$_} = join '^', @{$INPUT{$_}} for grep {"ARRAY" eq ref $INPUT{$
+_}} keys %INPUT
[download]

#!/usr/bin/perl -w

use strict;
use CGI;

my $query = new CGI;
my @params = $query->param;

foreach $param(@params) {
    $values = join '^', $query->param($param);

    # do what you want with the data here
}
[download]

You forgot to add the -T switch to turn on taint checking. Since this person is using this data to add to a database, they're probably constructing SQL statements with it. Thus, without taint checking, a savvy cracker can have fun passing values that delete databases, change information they shouldn't, or other nasty things.

See perlsec for details.

Cheers,
Ovid

Join the Perlmonks Setiathome Group or just go the the link and check out our stats.

I was told to "USE THIS CODE OR ELSE" by my manager.. heh..
thanks for your help :)

#!/usr/bin/perl

use CGI;

$q = new CGI;

@CheckBoxData = $q->param("checkboxName");

print "insert into table (colname) values ( \"@CheckBoxData\" )\n";

# or

foreach $v ( @CheckBoxData )
{
  # process the value
  print " insert into table ( colname ) values (\"$v\"  ) \n";
}
[download]