in reply to Short-circuited CGI Link

Hi. There are three issues to consider here, corresponding to each of the bits of the url you've removed.

Managing without the www part of the url is a dns issue, and to some extent an apache one. You need to make sure that myserver.com is pointing to the same place as www.myserver.com, and if there are name-based virtual hosts on that IP address you need to make sure that the two versions of the name are equivalent.

Then there's the /? part. That's fairly easy, as long as you don't mind switching on cgi processing outside of the ScriptAliased folders on your server. You can do that in httpd.conf, or just use .htaccess to achieve the same effect in a local way. Either way, the directives involved are roughly these:

Options ExecCGI AddType application/x-httpd-cgi .cgi DirectoryIndex index.cgi

/ is now equivalent to /index.cgi, and it'll be executed rather than just returned. has to be 755, of course.

Finally, you want to accept parameters in a minimal way. The dirty way to do that is just to read Env{QUERY_STRING}. Bad idea: very abusable. The good way is to use CGI and the keywords() method. this:

use CGI; my $query = new CGI; my $thing = join('',$query -> keywords());

Will give you the query string in $thing in a safer way. Perhaps you should still untaint it: i've never been sure about that.

hth

ps. it's possible to achieve the /? part with includes too, but it's less efficient and you have to read your parameters from $ENV{REQUEST_URI}.