in reply to RE: Re: Newbie Question
in thread Newbie Question
A security note: If, instead of using "filename.txt", you use a user-provided variable, make SURE your script uses taint-checking (-T argument, see perlsec) and un-taint the variable smartly before attempting to use it, or someone can easily put in a filename of "/etc/passwd" or "some.file;rm -rf /etc/httpd|", for example.system("./1.pl filename.txt"); # to stdout, or: my $output = `./1.pl filename.txt` # in $output
Since the script is a CGI script, its output will contain CGI headers. If this is OK, great. Otherwise, you will need to strip them out.
Perhaps you should consider an ASP technique for running a CGI script "within" the context of a page (with SSI this is called a "virtual include").
Hope this helps.
|
|---|