Beefy Boxes and Bandwidth Generously Provided by pair Networks
Your skill will accomplish
what the force of many cannot
 
PerlMonks  

Re: Re: (nrd) Quality Perl/CGI programs?

by coolmichael (Deacon)
on Feb 09, 2003 at 19:25 UTC ( #233940=note: print w/ replies, xml ) Need Help??


in reply to Re: (nrd) Quality Perl/CGI programs?
in thread Quality Perl/CGI programs?

I sat through a code review a few months ago. It was my first time, and quite the experience. The person's CGI script started just like yours does above. Then, about thirty or so lines in, there was

$filename =~ m/(.*)/gi; $filename = $1; open FILE, "$filename";
I was shocked, as this was code written by a "professional." I can count about six errors in those three lines of code.

  1. Poor taint checking (none really.)
  2. Not checking if the match succeeds. I guess it doesn't matter if it's just matching dot star.
  3. Not checking if the open succeeds.
  4. Should use the three form of open
  5. The match is stupid. dot-star doesn't care about case insensitivity (/i).
  6. The match is really stupid. /g is (i think) for trying to match multiple times in a loop. This doesn't do that.

You are quite right, warnings, strict, CGI, and taint are a good start. But you do need to still read the code before you use it. I don't think there is anything to help avoid a good code review.

update: The programmer still works there. I don't, by my own choice.

--
negativespace.net - all things inbetween.


Comment on Re: Re: (nrd) Quality Perl/CGI programs?
Download Code
Re:^3 (nrd) Quality Perl/CGI programs?
by newrisedesigns (Curate) on Feb 09, 2003 at 20:15 UTC

    coolmichael++. Whatever happened to the above code/programmer(s)?

    Another good measure of quality of a download-and-use CGI script is to see how many people use it. Of course, like shown above, this rule can also be broken (see MSA's formmail, v1.6 or less allows you to easily spam anyone).

    John J Reiser
    newrisedesigns.com

Log In?
Username:
Password:

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://233940]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others lurking in the Monastery: (10)
As of 2014-10-31 20:58 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    For retirement, I am banking on:










    Results (224 votes), past polls