in reply to Automatic Parameters for CGIs

CGI provides the import_names() method, which does nearly the same thing. It takes one argument, the name of the namespace into which to import the variables.

It also warns that this is a major security risk. If I happen to guess the name of one of your 'normal' variables and pass my own wicked bad parameters to your script, if you import into the main namespace, I can clobber any normal variable I can guess.

You cannot trust any of your normal variables after that happens. This is not something I recommend (and I seem to recall it's been responsible for a couple of security advisories for PHP, though I don't have a link offhand).

Use at your own risk.

Update: chipmunk says I should make it more clear that the security risk is importing variables into a package you're using. That's usually the main package, but any other package that doesn't expect it can be a victim.

Replies are listed 'Best First'.
Re: Re: Automatic Parameters for CGIs
by extremely (Priest) on Jan 19, 2001 at 06:08 UTC
    Wouldn't some of the lists (like a set of checkboxes with the same name) that take a variable number of arguments wind up sometimes being an array and other times being a scalar? That would suck.

    --
    $you = new YOU;
    honk() if $you->love(perl)

[reply]
      Actually, CGI's import_names() method imports every parameter as a scalar and as an array. The scalar will hold the first value for the parameter; the array will hold all the values, of course.

      The array be safely used in all cases, but the scalar is available for when you know that a parameter should only have a single value. 

      % perl -MCGI -de '$q = new CGI "single=1&multi=1&multi=2";' -e '1;'
 
Loading DB routines from perl5db.pl version 1.0402
Emacs support available.
 
Enter h or `h h' for help.
 
main::(-e:1):   $q = new CGI "single=1&multi=1&multi=2";
  DB<1> n
main::(-e:2):   1;
  DB<1> $q->import_names('Q')
 
  DB<2> V Q
$single = 1
@single = (
   0  1
)
$multi = 1
@multi = (
   0  1
   1  2
)
  DB<3>

      [download]
[reply]
[d/l]
        *grin* Hmmm, ok how about this, read the post as though I actually replied to the main thread rather than another post. (doh) My point was the original post was evil when in came to variable number same-name form posting. He tests on the item count, so sometimes you get $Blah::boxes and other times you get @Blah::boxes but NOT both like CGI. =)

        --
        $you = new YOU;
        honk() if $you->love(perl)

[reply]

In Section Code Catacombs