SECURITY RISK

[Anonymous Monk]

Hi,

You need to parse your string for ssl commands
$var =~ s/ < ! - - ( . | \ n ) * - - >//g;
don't include all the spaces in between < ! and so on until - >

[merlyn]

There's no security risk here in most systems, because the output of CGI is not generally parsed for SSI. Methinks you have a hair-trigger on that. :)

Even having said that,

$var =~ s/ < ! - - ( . | \ n ) * - - >//g;

is poor performing code. You want something like this instead:

$var =~ s/<!--.*?-->//gi;