#!/usr/bin/perl -wT                                                                                                                                        
                                                                                                                                                           
use strict;                                                                                                                                                
 use CGI;                                                                                                                                                  
 use CGI::Carp qw ( fatalsToBrowser );                                                                                                                     
 use File::Basename;                                                                                                                                       
                                                                                                                                                           
$CGI::POST_MAX = 1024 * 70000;                                                                                                                             
 my $safe_filename_characters = "a-zA-Z0-9_.-";                                                                                                            
 my $upload_dir = "/var/www/mnt";                                                                                                                          
                                                                                                                                                           
my $query = new CGI;                                                                                                                                       
 my $filename = $query->param("photo");                                                                                                                    
 my $email_address = $query->param("email_address");                                                                                                       
                                                                                                                                                           
if ( !$filename )                                                                                                                                          
 {                                                                                                                                                         
 print $query->header ( );                                                                                                                                 
 print "There was a problem uploading your photo (try a smaller file).";                                                                                   
 exit;                                                                                                                                                     
 }                                                                                                                                                         
                                                                                                                                                           
my ( $name, $path, $extension ) = fileparse ( $filename, '\..*' );                                                                                         
 $filename = $name . $extension;                                                                                                                           
 $filename =~ tr/ /_/;                                                                                                                                     
 $filename =~ s/[^$safe_filename_characters]//g;                                                                                                           
                                                                                                                                                           
if ( $filename =~ /^([$safe_filename_characters]+)$/ )                                                                                                     
 {                                                                                                                                                         
 $filename = $1;                                                                                                                                           
 }                                                                                                                                                         
 else                                                                                                                                                      
 {                                                                                                                                                         
 die "Filename contains invalid characters";                                                                                                               
 }                                                                                                                                                         
                                                                                                                                                           
my $upload_filehandle = $query->upload("photo");                                                                                                           
                                                                                                                                                           
open ( UPLOADFILE, ">$upload_dir/$filename" ) or die "$!";                                                                                                 
 binmode UPLOADFILE;                                                                                                                                       
                                                                                                                                                           
while ( <$upload_filehandle> )                                                                                                                             
 {                                                                                                                                                         
 print UPLOADFILE;                                                                                                                                         
 }                                                                                                                                                         
                                                                                                                                                           
close UPLOADFILE;                                              
  print $query->header ( );                                                                                                                                  
print "<html>";                                                                                                                                            
print "<head>";                                                                                                                                            
                                                                                                                                                           
 print "<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />";                                                                        
print "<title>Thanks!</title>";                                                                                                                            
 print "<style type=\"text/css\">";                                                                                                                        
 print 'img {border: none;}';                                                                                                                              
 print "</style>";                                                                                                                                         
                                                                                                                                                           
print "<body>                                                                                                                                              
 <p>Thanks for uploading your photo!</p>                                                                                                                   
 <p>Your email address: $email_address</p>                                                                                                                 
 <p>Your photo:</p>                                                                                                                                        
 <p><img src=\"../mnt/$filename\" alt=\"Photo\" /></p>                                                                                                     
 </body>                                                                                                                                                   
 </head>                                                                                                                                                   
                                                                                                                                                           
 </html>";