•security alert TWO, was Re: Re: Contact Form


good chemistry is complicated, and a little bit messy -LW
	PerlMonks

•security alert TWO, was Re: Re: Contact Form

by merlyn (Sage)

on Mar 23, 2002 at 02:22 UTC ( [id://153705]=note: print w/replies, xml )

Need Help??

in reply to Re: Contact Form
in thread Contact Form

Oops. Twice in a row:

open MAIL,'|/usr/lib/sendmail -t' or die "error with email"; 
 
print MAIL "To: youremail@somewhere.com\n"; 
print MAIL "From: theiremail@somewhere.com\n"; 
print MAIL "Subject: form stuff\n"; 
 
print MAIL "name: ", $query->param(name), "\n"; 
print MAIL "subject: ", $query->param(subject), "\n"; 
print MAIL "email: ", $query->param(emailaddy), "\n"; 
print MAIL "message: ", $query->param(message), "\n";
[download]

You aren't ending your header with a blank line, so what you think is in the body is still in the header, and hence could be used for spam! Also, you have an "@" inside a double-quoted string, and you're using barewords for "name" and "subject", etc, so "use strict" will be all over your ass for both of those, and rightfully so.

Maybe you should just concede at this point.

-- Randal L. Schwartz, Perl hacker