= rather than =~ ?

[bcrowell2]

This web page gives the following example:

You should also continue to master Perl if you want to ensure security. For example, if alarm bells don't immediately go off in your head when you see something like this:

  $input = /(\w+)/;
  my $keyword = $1;

then you need to keep studying. The problem with this code is that when the match fails, $1 is left over from a previous match. This kind of code can be used as a security exploit, if the attacker can access the source code or have an idea that this is happening. It's code that ``looks right'' but definitely isn't.

But isn't the use of the = sign, rather than =~, also incorrect?

[merlyn]

Good catch!

That should have been =~! Where were you when that was being tech reviewed? Or where was my brain when I was typing that?

Thanks... I'll add it as an errata.

[pg]

This note might confuse newbies, so I thought just add a comment.

"That should have been =~!"

What merly said is that, that was a typo, and not what he wanted. (As you can see, he is the owner of that web page.)

But as a Perl statement, it is absolutely valid, and jweed has already given a full explanation.

[diotalevi]

Goodness. And all this time I thought you had /meant/ it that way.

[jweed]

This is technically valid perl. Since no search string is specified, $_ will be searched, implicitly. Then, as perlop points out, the match in scalar context returns true when a match occurs and false when it doesn't. So $input will be true or false, based on whether $_ had one or more word characters.

[Anonymous Monk]

It depends. I don't know what $input is, but that code is matching against $_. If the match fails, the match fails. Such code should always be written something like $foo = $1 if /(foo)/;

[tachyon]

my $foo = m/(foo)/ ? $1 : '';

[ysth]

$foo = $1 if /(foo)/;

may be okay, but

my $foo = 1 if /(foo)/;

is not.

[Aristotle]

If you feel the need point that one out, you should probably also explain why that is.. :)

[SavannahLion]

[inman]

Another potentially confusing variation would be if list context was used since the match will return the list of matched sub-expressions. In the example below, $input is assigned a value for each iteration wheras $1 is only changed on a good match.

#! /usr/bin/perl
use strict;

my $input;
while (<DATA>)
{
    ($input) = /(\w+)/;
    print "\$input=$input\t\$1=$1\n";
}
__DATA__
Hello

World

Output:

$input=Hello    $1=Hello
$input= $1=Hello
$input=World    $1=World