in reply to Re^2: backtick in perl 5.8 cgi under iis 6
in thread backtick in perl 5.8 cgi under iis 6

I think you are missing the point. You should never need backticks. They are a security risk. Why don't you tell us exactly what you are trying to do?

Neil Watson
watson-wilson.ca

  • Comment on Re^3: backtick in perl 5.8 cgi under iis 6

Replies are listed 'Best First'.
Re^4: backtick in perl 5.8 cgi under iis 6
by ikegami (Patriarch) on Feb 17, 2006 at 16:42 UTC
    That's assuming user input is used to build the command string. If the command is hardcoded, or if interpolated data is well validated (matches /^\w+\z/, for example), there's no problem.
Re^4: backtick in perl 5.8 cgi under iis 6
by cseelig (Initiate) on Feb 17, 2006 at 16:23 UTC
    The cgi code wants to "run" an external process and capture its output for processing.

    BTW - it's an intranet application; security is not a concern.

    How can I achieve this without backticks?

    Thanks.

      cseelig,

      "BTW - it's an intranet application; security is not a concern."

      Yikes! IMHO security should always be a concern.
      Check out CGI Programming FAQ under Security for some interesting reading.
      Update: Also merlyn has a great article on the subject of security which I would advise reading.

      Martin
        Ok. So how would you do it?
        (Where "it" is to have a Perl cgi script invoke an external executable and capture the results for subsequent processing.)
      Have you tried supplying the full path to the exe?
      my $output = `c:/path/to/program.exe`;