in reply to Variable Substitution within NameSpace

Creating a variable whos name is that of the value held in another variable or as literal text is called a symbolic reference. It's almost never the right way to do things, and unless you know intimately why not to use them, you're probably not presenting one of those few cases where they are the right way to do things.

Let's say, for example, someone hits your CGI script with a page they've created themselves (instead of your page), and they submit a name of 'fh'. Now let's say your script already uses a variable named $fh... maybe it's going to be a filehandle you open later in the script. Oh oh, suddenly the script won't work because the name supplied by this malicious user's concaucted form submission conflicts with a variable name you're using in the script. Never let the outside world create variable names within your script. BAD BAD.


Dave

  • Comment on Re: Variable Substitution within NameSpace