I think astanley's on the right track, but I might take a combined approach.

Before installing a free package, read the source and see if the basics are covered: Does it

• use -wT?
• use strict?
• untaint input lightly (e.g. no .* isssues.)

If so, then ask your friend to do a quick once over. That shouldn't take too long and might result in some interesting discussion.

Assuming that you friend is okay with it, then install it.

Finally, review some of these columns and see what you pick up. You may be surprised at how quickly you grasp the basics.

Also, be sure you read the following very carefully: perlsec and the WWW Security FAQ.

CGI Programming with Perl offers a good discussion on the subject, one nicely complemented by Writing CGI Applications with Perl.

--f