#! /usr/local/bin/perl -T
use strict;
use CGI qw(:standard upload);
use HTML::Entities;
print header(), start_html('Upload Test'), h1('Upload Test'),
  start_multipart_form(), "Enter how many files to upload: ",
  textfield("filecount"), br();
for my $i (1..param('filecount')) {
  print "File $i: ", filefield(-name => "file$i"), br();
}
print submit();
for my $file (sort grep /file/, param()) {
  print p();
  my $handle = upload($file);
  unless (defined($handle)) {
    if ($file =~ /(\d+)/) {
      print h3("File request $1 did not return a handle\n");
    }
    next;
  }
  print p(), h3("Uploaded $handle"), br(), "<pre>";
  print encode_entities($_) while <$handle>;
  print "</pre>";
}
[download]

Hey Tilly, I tried it, but all I could get was internal server errors. Is HTML::Entities part of the standard perl distribution? I don't have a clue why it won't work.

HTML::Entities is off of CPAN so you may not have it. Sorry for not checking. For a quick test you can make the following modification:

--- files.pl    Sat Jan 13 11:31:40 2001
+++ files2.pl    Sat Jan 13 20:51:31 2001
@@ -1,7 +1,6 @@
 #! /usr/local/bin/perl -T
 use strict;
 use CGI qw(:standard upload);
-use HTML::Entities;
 print header(), start_html('Upload Test'), h1('Upload Test'),
   start_multipart_form(), "Enter how many files to upload: ",
   textfield("filecount"), br();
@@ -19,6 +18,11 @@
     next;
   }
   print p(), h3("Uploaded $handle"), br(), "<pre>";
-  print encode_entities($_) while <$handle>;
+  while (<$handle>) {
+    s/&/&amp;/g;
+    s/</&lt;/g;
+    s/>/&gt;/g;
+    print;
+  }
   print "</pre>";
 }
[download]

(The solution with the original module is able to handle unexpected input better though.)

Also it sounds like you have not yet discovered your server error logs. If you are on a Unix-like system it will be something like /var/log/apache/error.log. When you get these internal errors the tail of that will have all sorts of useful information. In similar vein you should try running the CGI script interactively, that can identify many problems.

Several other good tips are here - highly recommended despite the name. (A little dated now, but good advice nonetheless.)

<form enctype='multipart/form-data' ...>
<input type='file' name='file' ...>
<input type='file' name='file' ...>  (repeat)

use CGI ':standard';
use File::Basename;

foreach (param('file')) {
   my $basename = basename($_);
   $basename =~ tr/A-Za-z0-9.//cd;    # strip out unwanted crap
   open(FILE, "> $basename") or die "$basename: $!";
   print FILE <$_>;
   close(FILE);
}
[download]

$basename =~ tr/[A-Za-z.]//cd;      # strip out unwanted crap
[download]

Did you really want to leave in the square brackets? Remember, tr is not s. {grin}

-- Randal L. Schwartz, Perl hacker

Speaking of stripping out unwanted crap... ;)