Beefy Boxes and Bandwidth Generously Provided by pair Networks
Perl Monk, Perl Meditation

Re: Making webpages from a single CGI

by Zecho (Hermit)
on Oct 04, 2001 at 02:01 UTC ( #116584=note: print w/replies, xml ) Need Help??

in reply to Making webpages from a single CGI

First, your use of ReadParse was a little over the top
Second when you want to print a block of html, use "s if you want to interpolate and 's if not.
Third, use strict and warnings.. They will give you a lot of answers on their own

The following works fine if the request is something like
#!/usr/bin/perl -w use strict; my $Final; my $Good_Stuff; if ($ENV{'REQUEST_METHOD'} eq 'GET') { #Check to see which one it is $Good_Stuff = $ENV{'QUERY_STRING'}; #Split up the information } elsif ($ENV{'REQUEST_METHOD'} eq 'POST') { read(STDIN, $Good_Stuff, $ENV{'CONTENT_LENGTH'}); } ($Final) = split(/=/, $Good_Stuff,1); #Grab the filename $Final =~ s/%(..)/pack("c",hex($1))/ge; #Just for fun #Print out lots of stuff (this never works, though). print "Content-type: text/html\n\n"; print <<'ENDMETA'; <HTML><HEAD> <META NAME="GENERATOR" CONTENT="Adobe PageMill 3.0 Win"> <TITLE>Animetion Station &gt; Webcomic &gt; $Name</title> <LINK REL="stylesheet" HREF="Style.css" TYPE="text/css"> </head> ENDMETA print <<"ENDHTML"; <BODY> <P><CENTER> <DIV STYLE="background-color: #0099FF; font-family: Comic Sans MS; fon +t-size: 20px; width: 200px; color: white;"> Web Comics</div></center></p> <P> <TABLE WIDTH="757" BORDER="0" CELLSPACING="1" CELLPADDING="0" HEIGHT=" +294"> <TR> <TD WIDTH="14%" VALIGN="TOP" ALIGN="CENTER" HEIGHT="293"> <!--#include file="Sidebar.txt"--> </td> <TD WIDTH="86%" VALIGN="TOP" BGCOLOR="#3366ff"> <P><IMG SRC="$Final"></p> <P><IMG SRC="Images/Comic_Face.jpg" WIDTH="57" HEIGHT="54" ALIGN="BOTT +OM" BORDER="0" NATURALSIZEFLAG="3"> <IMG SRC="Images/Comic_Face2.jpg" WIDTH="60" HEIGHT="55" ALIGN="BOTTOM +" BORDER="0" NATURALSIZEFLAG="3"> <IMG SRC="Images/Comic_Face3.jpg" WIDTH="60" HEIGHT="62" ALIGN="BOTTOM +" BORDER="0" NATURALSIZEFLAG="3"> <IMG SRC="Images/Comic_Face4.jpg" WIDTH="60" HEIGHT="60" ALIGN="BOTTOM +" BORDER="0" NATURALSIZEFLAG="3"></td> </tr> </table> </body></html> ENDHTML

Replies are listed 'Best First'.
Re: Re: Making webpages from a single CGI
by chromatic (Archbishop) on Oct 04, 2001 at 05:18 UTC
    The following works fine if the request is something like

    What if the request is something like!--%20#include%0Afile=%22/etc/passwd%22--%3E%3Cspan%20id=%22foo

    Alright, I'm picking on you for comments like "This never works" and "Just for fun". If you're not sure what something does, please find out before you recommend it to someone else.

    Using will not fix the exploitish URI above, though it will prevent you from hand rolling form parsing code. Reading through perldoc perlsec won't automatically fix the potential security hole, but it will help you think in terms of how to minimize the risk. ©

      Actually, I was attempting to stick with his original code and comments, as well as his original request. Yes obviously there is more to parsing query strings, and that should be something he investigates. I was just attempting to fix what he had already written
        hmm, you could make a great big comment showing him the error of his ways, eg:
        # USED FROM - Read it, use it, love it!
        and then proceed to cut/paste the code you'll need from*. On occasion, we don't want to use those modules which are there to make our lives easier; but there's no point in re-writing the code you would want to use.
        In fact, if it's just for learning purposes, what better code is there to use as an example than something tried and tested. (I learned more from doing things like that than I'd ever expected)

        But that's just my $0.02.
        *NOTE: if you decide to do that, now or later, and actually plan on implementing it, be certain you understand what you're pasting, and (sometimes) more importantly what you're not pasting, that you might need.
        good luck,

Log In?

What's my password?
Create A New User
Node Status?
node history
Node Type: note [id://116584]
and the web crawler heard nothing...

How do I use this? | Other CB clients
Other Users?
Others wandering the Monastery: (4)
As of 2021-04-21 00:01 GMT
Find Nodes?
    Voting Booth?

    No recent polls found