Ok, lately this was the second time that someone posted an entire CGI script at PerlMonks, complete with the (presumably) correct address the CGI script is (or will be) available at. (Well, actually, this is the third time. The first node was this one: Do not undertand this error message and Nik does it for the second time, too...)

In order to understand, why this is an exceptionally bad practice, you have to be aware of the basic methodology of cracking a web page. At least 90% of the work you do when you want to abuse a web site is actually gathering of relevant information:

• type and version of the OS and the web server software in the hope that you find a public exploit for a potentially unpatched vulnerability
• DNS entries, phone numbers for easy social engineering
• path names and file names of CGI scripts for code injection attacks
• the type of the underlying database engine, valid user names known for the databases, names of tables and columns in the database tables for SQL injection attacks
• and countless more...

When you got all these relevant information, it is not particularly hard to devise an easy way to hack into someone's web site.

Observe that you give all these information very nicely in your post, so you do he majority of the hard work of the attacker. And this is exactly why crackers often hang around at sysadmin forums and mailing lists: these places are invaluable sources of easy information...

Do yourself a favour: only post stripped down versions of your CGI scripts and remove all sensitive pieces of data (as you did very cleverly with the passwords). This will also make it easier for other monks to consume your question by the way...

Update: rephrased a bit...