merlyn was responding to a request for one variable to
have the name of another. This is a bad idea for reasons
that Dominus explained at length
here. Of course
accepting and processing arbitrary keys in a safe manner
(eg in a hash) is safe. The only possible confusion then
will be that (like globals) the same name will get used
twice in two places and the two will get confused for
each other. Of course then you just have multiple keys
which between them are a unique identifier. One for the
data elment in the form, one for the form. | [reply] |
Thanks for the reply! It's nice to get some feedback on this node.
Going back to the original node, I see that the poster asked "how do I make an associative array that holds each of the variable names and its corresponding value?" There was never any question of symbolic references, or even of using CGI's import_names method. The original poster was simply using 'variable name' to mean 'parameter name'.
So, really, it seems that we agree. Accepting arbitrary parameters in a CGI script is not necessarily a security risk. It becomes a risk only if the parameters are handled in an unsafe way.
| [reply] |