Query about queries

[edatz]

Hi, just a quick question. I use the below to parse an SSI query to a flat file database.

if ($ENV{'QUERY_STRING'}) {
@pairs = split(/&/, $ENV{'QUERY_STRING'});
foreach $pair (@pairs) {
($name, $value) = split(/=/, $pair); # Do need this

# do I really need these for the SSI query? Works without them (shoulder shrug)
#$value =~ tr/+/ /;
#$value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C", hex($1))/eg;
#$value =~ s/<!--(.|n)*-->//g;
#$value =~ s/<([^>]|n)*>//g;

$FORM{$name} = $value; # Do need this
} # end foreach
} # end if env

my SSIs look like this:
<!--#include virtual="/cgi-bin/aaaa/script.pl?action=thisent&id=20110328203439" -->

I've tried running it without various bits (now commented out) and everything still runs okay in various browsers.

Normally I'd use those when processing forms, but this not a form, more like parsing an SSI like it is a form.

So I guess I don't really need those to do the job. Yes?

Any thoughts?

[Sixtease]

Heh, well, you don't need it as long as users behave nicely and don't send you nasty parameters. I've not inspected the lines very carefully but they're likely there to take care of edge cases when the user sends something not so usual in a query parameter.

So removing the code, you're likely exposing yourself more to hackers. Keeping the code (that neither of us understands and that's of questionable robustness), you're also exposed to hackers. Solution? Use a goddamn module. CGI parsing is one of the classic tasks that you just won't write better than it's already written. There are plenty lightweight modules that won't put virtually any performance hit to your code and you can even inline the packages if you really can't stand dependencies. So please, do yourself the favor and look for example at CGI::Minimal (http://search.cpan.org/perldoc?CGI::Minimal).

[edatz]

Hi Sixtease, hope you're well. Thanks, I'll have a look at that module.
You still working in Vienna?

[Sixtease]

Howdy. I'm well, thx. Still in Vienna, yes. :-)

[edatz]

That's good, same job I trust. Last summer you went to Mongolia, what are you doing this year?

I'm home, having now retired I have more "spare" time :), so am coding some new blog software aimed at coders and the like. Tried using the forum scripts as a base, but there was trouble with Google Blog Search ping not liking item links to the cgi-bin (odd, but there we are), so had to start over from scratch. Trying to keep it as small as possible.

Wouldn't mind a few weeks somewhere away from London though - can't stand the place personally (even tho' we live in an outer suburb).