in reply to Re: Re: Re: Re: (Ovid -- bug in your hand-rolled CGI code) Re: Pushing w/ an associative array?
in thread Pushing w/ an associative array?

What I need to do is, since the script has to be able to handle ANY form that gets thrown at it, is take the variable names and put them in an array. That way, I can go through the array and use the param() function to get the value. When I do just a blank param() I only get the values.
  • Comment on Re: Re: Re: Re: Re: (Ovid -- bug in your hand-rolled CGI code) Re: Pushing w/ an associative array?

Replies are listed 'Best First'.
Re: Re: Re: Re: Re: Re: (Ovid -- bug in your hand-rolled CGI code) Re: Pushing w/ an associative array?
by davorg (Chancellor) on Dec 27, 2000 at 23:58 UTC

    merlyn is right about what he says about security risks, but my code does does handle any form that is thrown at it. You can get the list of form parameters it has processed by using:

    keys %form
    --
    <http://www.dave.org.uk>

    "Perl makes the fun jobs fun
    and the boring jobs bearable" - me

Re: Re: Re: Re: Re: Re: (Ovid -- bug in your hand-rolled CGI code) Re: Pushing w/ an associative array?
by merlyn (Sage) on Dec 27, 2000 at 22:37 UTC
    This is already smelling of a potential BIG security hole. Can you tell us more about your application? Why would you need to be able to handle any combination of form elements?

    -- Randal L. Schwartz, Perl hacker

      Basically I've got a few different forms for people to submit stuff, one is a grocery list, the other is a list of people to contact in an emergency, etc.

      I'd like to make it so that this script can handle either form, instead of writing out a separate form for each script. Although now it seems like its taking way longer to code around this =)

      Thats the reason I need to have the name of the variable that the value is coming with.

        What you are asking for is very basic. Read through the CGI.pm documentation if you'd like more examples. The code snippets that have been posted here seem to cover exactly what you are looking for. If you need the name of all "variables" in your form, you do this:
        #!/usr/bin/perl -wT use strict; use CGI; my $q = CGI->new; my @vars = $q->param; # <-- That's all there is to getting 'em
        It's pretty simple. I don't see what you are having trouble with. That will handle any form you want to throw at it.

        Cheers,
        Ovid

        Join the Perlmonks Setiathome Group or just click on the the link and check out our stats.

        And then you get all this coded, and someone calls your script handing it a bunch of parameters you don't expect. If you act on them, you are in for a big surprise. But how will you know to reject them? Right... you'll need to know this in the script. Now you're back to a list of known parameters, and you don't need to handle "anything that comes in". End of problem.

        -- Randal L. Schwartz, Perl hacker