Re: Perl calling Linux commands

[tmharish]

in reply to Perl calling Linux commands

If you had printed the system command that you were running you would have figured this out.

Update

Just to show what I meant consider what happens when your code is modified like so:

my $command = qq("svr_submit_RAST_job --user "$username" --passwd "$Pa
+ssword" --fasta "$fasta" --domain "$domain" --genetic_code "$Genetic_
+code") ;

print "\n\n\nGoing to run the following through system:\n $command\n";

Output

Enter the Rast Username
username
Enter the Rast Password
password
Enter the fasta file Name
filename
Enter the Domain Name
domainname
Enter Genetic_Code
geneticcode



Going to run the following through system:
 "svr_submit_RAST_job --user "username
" --passwd "password
" --fasta "filename
" --domain "domainname
" --genetic_code "geneticcode
"

And the newlines are there for you to see, as plain as daylight.

[tmharish]

Additionally you need to look at tainted variables.

Its a really bad idea to take user input and throw it to system ( or a database ) - What if the username input was:

" || ls && 0 && 

Of course you could replace ls with whatever exciting nefarious command you choose but thats the idea ...