Re^2: Howto include Perl Script into CGI script

[monkfan]

(You could also run the Perl script by using back-quotes, shell-script style.)

Hi BerntB,

Thanks for your answer. Can you be a bit specific? Example?
Here is what I have at the moment:

sub print_results {
    my @top = param('toppings');
    print b('Customer name: '), param('customer'), br,
    "You ordered  ",
        param('no_unit'), ' unit of  ', param('cone'), ' cone.';
    print br;

    my $value = `perl compute_price.pl -type param('cone') -unit param
+('no_unit')`;

    # Still doesn't show the value. What did I do wrong??
    print 'Total price is', $value;
}

But it doesn't show the price as you try see from the link I have above. Is there anything I did wrong?
It seem to me CGI script has different property with Perl script. Maybe backquote is not for it?

[BerntB]

The "param('no_unit')" parts (inside the backquotes) are evaluated as shell script. Set them to variables and have the variables inside the "`".

Update: Please note the dangers of "injecting" stuff like shell commands into your backquotes-eval if you use data that comes from the CGI! Use taint and/or the system() call with multiple parameters. (I.e. do system("perl", $param1, $param2);)

[monkfan]

Use taint and/or the system() call with multiple parameters.

I learnt so much from your replies.
How do you actually do the "tainting", in my OP above?

[wfsp]

#!/usr/bin/perl -wT

Turns on taint checking.

Have a look at Ovid's CGI Course, lesson 3, Basic CGI Security for a discussion on why and how to use it.