--- Dianne Van Dulken <[EMAIL PROTECTED]> wrote:
> I am receiving a lot of values from a form. I want to loop through them and
> set new variables, with the same name, to the same value. EG: I want the
> param value phone to be set to $phone.
>
> Sorry if it's too stupid a question, and you all go "Tchah, moron!" at me
> (please feel free to, as long as you also let me know exactly WHY I'm a
> moron, 'cause as I said, it's annoying me).
Dianne,
You're not being a moron. You're asking a question that many people wonder about.
However, what
you want to do is a really, really bad idea. *Why* it's a bad idea, however, isn't
obvious.
Consider the following program:
#!/usr/bin/perl
use CGI qw/:standard/;
$file = 'somefile.txt';
foreach ( param ) { # this will do what you want
$$_ = param( $_ );
}
if ( $user eq 'ovidius' && $pass eq 'naso' ) {
open FILE, $file or die $!;
print header( -type => 'text/plain' );
while (<FILE>){ print };
} else {
# do something else
}
Basically, you want to validate a user and let them read a file. Here's the problem
with that
script:
http://www.domain.org/script.cgi?file=%2Fetc%2Fpasswd&user=ovidius&pass=naso
As you can see, the filename has now been embedded in the URL, has overwritten your
filename, and
the cracher gets to read /etc/passwd. It's not immediately obvious, but there are
many, many ways
of exploiting what you have done. Plenty of other variables could be overwritten.
For example,
what happens if someone passes a param named '['? The variable '$[' is the first
index of an
array or list. Now, none of your array processing will match.
The proper way to do what you've done is to use a hash. The following is a fairly
straightforward
example. Pardon me if it seems pedantic as I have no idea what your experience level
is with
Perl.
use CGI qw/ :standard /;
use strict;
my %form_data;
foreach my $name ( ¶m ) {
my @values = param( $name );
$form_data{ $name } = @values == 1 ? $values[ 0 ] : \@values;
}
I don't know if you've seen the trinary operator (if ? then : else) before. What it
does is, if
the expression before the question mark is true, returns the results of the expression
immediately
before the colon. Otherwise, you'll get the results of the expression immediately
after the
colon. That may sound confusing, but here's a practical example:
http://www.domain.org/script.cgi?name=ovid&color=red&color=blue
You'll notice that there are *two* name/value pairs for 'color'. This is perfectly
valid and
fairly common. For example, if you sign up for a mailing list and check off a bunch of
preferences, you may have multiple name/value pairs named 'preference', but with
different values.
It makes CGI programming much easier once you get used to it.
The script above will see the name param and realize that the @values array has only
one element
(@values == 1). As a result, $form_data{'name'} will be set to $values[0], which in
this case is
'ovid'.
When the script sees 'color', it will see that @values does not have one element (in
this case
meaning it has more than one) and will set $form_data{'color'} equal to a reference to
an array
containing the values 'red' and 'blue'.
Later, to get the data for name, you would just use $form_data{'name'}.
Getting the colors will be trickier. Here's one example:
foreach my $color ( @{ $form_data{ 'color' } } ) {
print "This color is: $color";
}
For most beginning CGI work, $form_data{'someval'} is what you'll use and you won't
have
references to arrays or anything like that.
For more information on why using variables for variable names is a bad idea, you may
wish to read
the following articles by Mark-Jason Dominus. They are an *excellent* reference.
http://perl.plover.com/varvarname.html
http://perl.plover.com/varvarname2.html
http://perl.plover.com/varvarname3.html
That was a fair amount of stuff, so let us know if you have any questions.
Cheers,
Curtis Poe
=====
Senior Programmer
Onsite! Technology (http://www.onsitetech.com/)
"Ovid" on http://www.perlmonks.org/
__________________________________________________
Do You Yahoo!?
Make international calls for as low as $.04/minute with Yahoo! Messenger
http://phonecard.yahoo.com/
--
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
