PDA

Click to See Complete Forum and Search --> : Need help writing a cgi script.

Thuro
05-18-2005, 06:57 PM
I want to make a form so that users can input their name and user number (in separate fields) then they would click a submit button and it would be emailed to our email address, also i would like that their name be added to a list on the webpage so that when they come back to the webpage they can see that they are registered for that event. I would really appreciate any help, thanks in advance.

Thuro
Nedals
05-19-2005, 10:06 PM
Bare bones to get you started...

#!/usr/bin/perl

use strict;
use CGI;
my $q = new CGI;
my $mailprog = '/usr/lib/sendmail'; ## set for your server

my $name = $q->param('name');
my $number = $q->param('number');
my $email = $q->param('email'); ## get thier email address

# Check to make sure that name and number are in a valid form.
# ie: name contains only a..z and space
# number contains only 0..9

# append name and number to a file or database

# email to you
open(MAIL,"|$mailprog -oi -t") || die "Could not open the UNIX email program";
print MAIL "From: $email\n";
print MAIL "To: yourname\@domain.com\n";
print MAIL "Subject: ....subject....\n";
print MAIL "...message...\n";
close(MAIL);

# Get list of names from file or database formatted as needed
my $names = .....

# return an HTML page
print $q->header()
print <<HTML
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">

<html><head><title>untitled</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>

<body>
.. whatever ..
$names
</body>
</html>
Charles
05-20-2005, 12:40 PM
But if you're going to use the GCI.pm module then you ought to us the CGI.pm module.#!/usr/bin/perl

use strict;
use CGI;
my $q = new CGI;
my $mailprog = '/usr/lib/sendmail'; ## set for your server

my $name = $q->param('name');
my $number = $q->param('number');
my $email = $q->param('email'); ## get thier email address

# Check to make sure that name and number are in a valid form.
# ie: name contains only a..z and space
# number contains only 0..9

# append name and number to a file or database

# email to you
open(MAIL,"|$mailprog -oi -t") || die "Could not open the UNIX email program";
print MAIL "From: $email\n";
print MAIL "To: yourname\@domain.com\n";
print MAIL "Subject: ....subject....\n";
print MAIL "...message...\n";
close(MAIL);

# Get list of names from file or database formatted as needed
my @names = .....

# return an HTML page

print $q->header,
$q->start_html (-title=>'Reply'),
$q->h3 ('Reply'),
$q->h4 ('Names'),
$q->ul ($q->li (\@names)),
$q->end_html;
Jeff Mott
05-20-2005, 08:22 PM
To bring a security issue to everyone's attention: consider what would happen if the following was submitted as the from email address.

"haxor@nowhere.net
Some-other-header-field: some-value"

By blindly incorporating whatever the user submits allows them to manipulate the entire header and body of the email. You should be aware of possible values for any header field and validate for that specifically, but the very least that you must do is to protect against a newline that might start a new header line.$email =~ s/\n(?=[^ \t])/\n /g;
Scriptage
05-24-2005, 01:59 PM
But if you're going to use the GCI.pm module then you ought to us the CGI.pm module.
What? I'm sorry but I'm getting rather annoyed with people doing this. There is no one specific correct way to use the CGI.pm module (apart from use CGI; pardon the pun). The beauty of perl is its ability to perform the same task in many different ways, an example of which is above. CGI.pm contains specific functions to aid the user in performing mundane tasks, ie: The ability to print out header information and meta tags. However, if one chooses to use print instead of start_html then there is nothing wrong with that.
If I wanted to program normally instead of OO is that incorrect?

use CGI qw(:all);

print header;

print param('This_is_correct');

I don't believe it is.

You sound to me as though you are just starting to learn perl Charles, and well done for doing so, but please refrain from pushing your morals and programming practices on the rest of us; because for the most part you are misinformed.

Regards

Carl
Charles
05-24-2005, 03:42 PM
Perl and I have been friends quite a while now and perhaps I've confused my purpose. I'm not trying to esatablish any one style, I'm just trying to illustrate some of the oft ignored features of that wonderful module. And you have to admit, it does seem a waste to use that huge module if you're just going to use it to generate the response header.
Nedals
05-24-2005, 03:43 PM
Charles..
As a follow up to Scriptage's comments..

I find CGI's method of outputting an HTML document difficult to read and maintain. So, frankly, I don't use it. However, I do use the form input methods of CGI.

For short, simple documents I use the 'here-is' construct (as above) which is really easy to read and understand. For more complex pages, I use HTML::Template. The main advantage of doing it this way, is that I can construct a valid HTML page and then easily incorporate that into a 'here-is' construct or a .tmpl file.
Scriptage
05-24-2005, 06:31 PM
And you have to admit, it does seem a waste to use that huge module if you're just going to use it to generate the response header.

Thats just like saying why drive a car if you're not going to use the glove compartment?

I agree with Nedals completely, it's difficult to read and maintain.
Charles
05-24-2005, 08:16 PM
Thats just like saying why drive a car if you're not going to use the glove compartment?

I agree with Nedals completely, it's difficult to read and maintain.It's more like saying Why by the Craftsman 999 piece tool set when you're only going to use a pair of pliers?

And using the CGI.pm module to generate the elements does have some advantages, it keeps your mark up at least well formed and when used with forms it automatically saves state.
Thuro
05-24-2005, 10:20 PM
Sorry i hadn't seen the thread guys but thanks a lot for your help before i try any of that though heres what i've done so far:

my server has the formmail.pl installed and I used it to create a form that would email me the info, but it sucks cause it sends you to the formmail.pl page which is bassically all the information that was input on a white background, not really helpful for the look and feel of the site. and I am still nowhere on the displaying of the names on the page. Anyway here's the code i used to make it send me an email.

<form action="/cgi-sys/FormMail.pl" method="post" name="name" id="name">
<font size="2" face="Arial, Helvetica, sans-serif">
<INPUT
type=hidden value=arthur@gtfactory.jp name=recipient>
</font><font face="Arial, Helvetica, sans-serif">
<P><font size="2"><B>Name</B><BR>
<INPUT size=45 name=subject>
</font></P>
<P><font size="2"> <B>Address</B><BR>
<INPUT size=45 name=realname>
</font></P>
<P><font size="2" face="Arial, Helvetica, sans-serif"><b>City:</b><BR>
<INPUT size=45 name=realname2>
</font></P>
<P><font size="2" face="Arial, Helvetica, sans-serif"><b>State:</b><BR>
<select name="select">
<option value="Alabama">Alabama</option>
<option value="Alaska">Alaska</option>
<option value="Arizona">Arizona</option>
<option value="Arkansas">Arkansas</option>
<option value="California">California</option>
<option value="Colorado">Colorado</option>
<option value="Connecticut">Connecticut</option>
<option value="Delaware">Delaware</option>
<option value="Florida">Florida</option>
<option value="Georgia">Georgia</option>
<option value="Hawaii">Hawaii</option>
<option value="Idaho">Idaho</option>
<option value="Illinois">Illinois</option>
<option value="Indiana">Indiana</option>
<option value="Iowa">Iowa</option>
<option value="Kansas">Kansas</option>
<option value="Kentucky">Kentucky</option>
<option value="Louisiana">Louisiana</option>
<option value="Maine">Maine</option>
<option value="Maryland">Maryland</option>
<option value="Massachisetts">Massachisetts</option>
<option value="Michigan">Michigan</option>
<option>Minnesota</option>
</select>
</font></P>
<P><font size="2"><strong>Zip:</strong><BR>
<INPUT size=15 name=email>
</font></P>
<P><font size="2"><strong>E-mail:</strong><BR>
<INPUT size=45 name=email2>
</font></P>
<P><font size="2" face="Arial, Helvetica, sans-serif"><b>Year Make &amp;
Model of Vehicle:</b><BR>
<INPUT size=45 name=subject2>
</font></P>
<P><font size="2" face="Arial, Helvetica, sans-serif">
<INPUT name="submit" type=submit value="Send Email">
<INPUT name="reset" type=reset value="Reset Form">
</font></P>
</font>
</form>

sso anything to expand on this or maybe help it out to do some other stuff?

or just go another route what do you guys think?
Mike Burdick
05-24-2005, 11:05 PM
Don't mean to hijack this thread but....

Jeff,

Would you mind elaborating a little more on what you said?


Thanks
Jeff Mott
05-25-2005, 08:16 PM
If you had a lines printing to a mail message such asprint "From: $from\n";
print "Subject: $subject\n";and these values are derived from the user and you don't perform any checks, then they could input a value such as "some subject\nTo: spam-addresses@whatever.net, more-spam@somewhere.org". Which would then interpolate into the print statement like soprint "Subject: some subject
To: spam-addresses@whatever.net, more-spam@somewhere.org\n";Most of the time you can defeat spammers by hard coding the address to send to, but this security hole would allow the user to set any header fields they choose as well as have full control over the body of the message.

A header field cannot have any leading white space otherwise it is considered linear white space, that is, a continuation from the previous line. What the line of code I provided does is add a space after every newline that is not already followed by a space or tab.

An even better solution would be to compose your message with the MIME::Lite module, which will provide the same protection automatically.
Mike Burdick
05-25-2005, 09:42 PM
Jeff,

Thanks for taking the time to answer me! To be honest with you, I don't understand much of what you said but it will provide me a starting point in trying to research the topic.

After I study it a bit I may have more questions for you. Hope you don't mind.

Mike