CGI.pm to the rescue. Files uploaded via the CGI upload form element create a temporary file on your system already (this is a CGI.pm behavior). The file is automatically unlinked when the script cleans up after itself (behind the scenes). The canonical way to handle uploads is to immediately save them to your own explicit file. But in your case, you're looking for a way to avoid saving the file explicitly. Fortunately, CGI.pm allows you to access the temp file directly. See the following, clipped from the CGI.pm documentation:

When processing an uploaded file, CGI.pm creates a temporary file on your hard disk and passes you a file handle to that file. After you are finished with the file handle, CGI.pm unlinks (deletes) the temporary file. If you need to you can access the temporary file directly. You can access the temp file for a file upload by passing the file name to the tmpFileName() method:

       $filename = $query->param('uploaded_file');
       $tmpfilename = $query->tmpFileName($filename);
[download]

The temporary file will be deleted automatically when your program exits unless you manually rename it. On some operating systems (such as Windows NT), you will need to close the temporary file's filehandle before your program exits. Otherwise the attempt to delete the temporary file will fail.

So what you could do is allow a file upload, and then process the file in-script without ever saving it explicitly to disk. Be sure to limit the upload file size to something reasonable by setting $CGI::POST_MAX to a value that is large enough for your needs, and small enough to prevent Denial of Service Attacks. Also please remember that any script running via a webserver is potentially running many instances at the same time (Apache forks off multiple processes to accommodate many clients simultaneously). So any memory usage your script creates could potentially be multiplied by the number of site users hitting your script at the same time. The result could be that a script which is already a memory hog, when multiplied by a few instances, could create a real problem on your server. That's one reason why it's common practice to keep large data in files or in a database rather than dealing with them entirely in memory.

Okay, the problem is, I don't actually have a param('uploaded_file'). There's no file-NAME associated with the binary data I want to output.

Once I process the uploaded zipfile, the processed output is raw binary data that gets generated (What's really going on, is that I feed the uploaded file to an external java program, then that java program spits out raw binary data, that raw binary data is a zip file)

Maybe I can do something like upload($binary_contents) or something like that?

Regarding the DOS service attacks, it's a script that would be used by only a handful of people internally, so that's not really something I'm concerned about. We should be okay with a slow running, memory hogging script. :-)

With all the support out there for storing session data (including larger files), why the strong aversion to doing it the traditional way? If you need to maintain data across page loads, you're maintaining a session's state. CGI::Session helps with that. And it's just one of many. Also Apache::Session, and many others. Dealing with session data becomes simple if you use the right tool.




Dave

Anyway, the problem is likely that $cgi->hidden doesn't make any effort to escape any non-printable characters.

i don't necessarily want to, but I don't want to explicitly save to a file on disk. Any alternatives? What about something like cgi->upload() using binary data instead of a filename. Does that exist?

!/usr/bin/perl

use warnings;
use Carp;
use CGI qw(param);
use CGI::Carp::DebugScreen;

open( OUT, '>>/root/Desktop/zip.out' );

CGI::Carp::DebugScreen->debug(1);

my $q = CGI->new;

binmode OUT, ':raw';
my $name = $q->param('content_of_zip') || "Content";
my $out  = $q->param('output')         || "Binary";
$q->save(OUT);
close OUT;

# now double-check to see if it was saved.

open( IN, '/root/Desktop/zip.out' );
while ( not eof IN ) {
    $q = CGI->new;
    print $name, "\n", $out, "\n";
    exit 0;
}
close IN;
[download]

also, you need to call the new method twice.

you don't need to do it in a loop

alright, I'm being unclear. I'll try to be simple

1. user uploads zip in a form

2. on form submit (action=site.cgi) zip is processed using some external program

3. the output of the external program can be either a zip or HTML (raw output, not a file)

4. if I just do "print $my_program_output", the html output will reload/replace the page, but the zip will just present a zip file for download without reloading the page behind it (this works fine, without having to write the output to a file)

here's my problem: In the case of the zip file, I want to refresh the original page (or have access to its content with javascript), but I don't know how to do that. And I want to avoid having to open a new file and write to it.

That's as clear as mud. Why don't you do this: give us 3 bytes of the binary data, and then type out exactly how you want that displayed on your webpage. Do not explain anything. Do not clarify. Do not pontificate. All your post should contain is:

1) This is 3 bytes of my binary data.

2) This is how I want it to look on my web page.