I've seen a fair few e-commerce (shopping cart based) implementations under Perl and I've yet to come across a really bad one.

At my last company we used Intershop (now called ePages I think) to build everything from small bookshops to large business-to-business stores for industrial parts. It's a bit of an expensive solution as it's a commerical application but it shows what's possible.

As to Perl being slow; that's a common misconception. Yes, Perl is slower than a natively compiled C/C++ program but it's fast enough for most applications and it's always been fairly effiecient at managing resources in my experience.

If you've seen quite a few Perl shopping carts and think that you've yet to see a really bad one, then I question your ability to identify serious problems.

Have you never seen a shopping cart that lets the user change prices by submitting hidden form fields?

Have you never seen a shopping cart that is vulnerable to SQL injection attacks?

Have you never seen a shopping cart that stores your current location on the server and therefore doesn't let you navigate through two parts of the site in parallel (for comparison shopping purposes)?

How about ones that let you store user comments - and were then vulnerable to cross-site scripting attacks?

Or have you seen shopping carts that made any or all of these mistakes but you didn't know enough to realize it? Which is more likely?

I never said they were all good - just the ones I've come across so far. I think it's a bit much to be attempting to judge my abilities simply on a single comment made on this site.

Yes, maybe I've missed the odd thing, but I also never said I was the oracle of all things Perl, IT, Internet etc etc etc

I was simply attempting to make the point that Perl can indeed be used to create a decent solution as demonstraited by several products already on the market.

You make some valid points about possible vulnerabilities (which surely are possible in a solution written in any language?) but you could have phrased them in a slightly less patronising way.

You don't know me, I don't know you. Please keep the comments to Perl and keep them constructive.

--- Jay

All code is untested unless otherwise stated.

#/usr/bin/perl
use warnings;
use strict;
use Turbo;
use CGI::Application;
use Shopping::Cart;
...
...
[download]

It's really extremely difficult to find something that will convenient for all: for beginners, for skilled perl users etc.
I looked hundreds perl shopping cart system in internet, the majority of them does not fall outside the numbed, stubborn scheme, like this: 'category' > 'quantity' >'add item'> 'checkout' > 'fill form'.. etc So what if you do have no categories, q-ty only one for each item, youdont need online cc transactions,-you need only send order by email.

No any of perl shopping cart does not work for mentioned scenario, for simple catalogue.

For such a setup, you need a simple form-mail script, like the NMS TFmail script, as provided by the excellent nms Perl CGI scripts. You set up a plain HTML page like:

<form action="http://www.example.com/cgi/mail.pl">
  Customer name:   <input type="text" name="customer_name" /><br />
  Customer street:   <input type="text" name="customer_street" /><br /
+>
  Customer ZIP:   <input type="text" name="customer_zip" /><br />

  Widgets: <input type="text" name="quantity_widgets" /><br />
  Doodads: <input type="text" name="quantity_doodads" /><br />
  Gadgets: <input type="text" name="quantity_gadgets" /><br />
  <input type="submit" />
</form>
[download]

and you will receive an email whenever a customer clicks the "submit" button. You are looking in the wrong aisle by looking for a "shopping cart solution", when all you seem to want is a simple script that mails you the results as a single form has been submitted.

good cart? to run on what sort of site; what sort of machine?

And what led you to your conclusion that perl is "slow" and takes "big resources?" If that's uninformed bias, we'd love to see you come to see things differently. If you'd like (in another thread, please) to explore why some script appears "slow" that's fine, too... but do remember -- good questions and an open mind go a long way.

Good means stable and free(work on Unix), and with no configuration(or almost with no).. Most commercial perl solutions I saw are useless and worthless.. There are no sence to pay hundreds dollars for useless 'store'

http://www.home-school.com/catalog/
Add item to cart...
http://www.home-school.com/cgi-local/cart.pl

You could do the same, or you could pay one of the Perl Monks a hundred or two to write / set you up one to your specs. Sounds like you just want a stripped-down cart with very few features but a lot of speed.

Your shopping cart seems to have one of the vulnerabilities mentioned above:


<input value="15.00" name="price0" type="hidden">
[download]

Please correct me if I am wrong, but I think your cart just ganted me 30$ discount ;-)

With things like that, the values that are getting passed around should be for front-end display only - the only really important information that needs to be passed back is what item you want and how many. You should already know what items cost so when you recieve an order you can bill accordingly.

--- Jay

All code is untested unless otherwise stated.
All opinions expressed are my own and are intended as guidance, not gospel; please treat what I say as such and as Abigail said Think for yourself.
If in doubt ask.