Just a few comments on that script. First, always use strict and taint mode.
$filename =~ s/.*[\/\\](.*)/$1/;
Slashes are not the only special characters used by OSs. It is safer to have a list of characters that you know are allowed and remove all else. Or just encode the entire sequence into a hex string.
Code:
$filename =~ tr/a-zA-Z0-9_.//cd; # -or-
$filename = unpack 'H*', $filename;
open UPLOADFILE, ">$upload_dir/$filename";
while (<$upload_filehandle> ) { print UPLOADFILE; }
close UPLOADFILE;
Always check the return value of open. What if two files are uploaded with the same name? The file should be locked. What if they're uploaded at the same time (known as a race condition)? By default files are written to and read from as text. Use binmode so it is treated as binary data.
print <<END_HTML;
<HTML>
<HEAD>
...
This isn't valid HTML. Not really a Perl issue, but still should be fixed.
This isn't doing anything.
for(split(//,'))*))91:+9.*4:1A1+9,1))2*:..)))2*:31.-1)4131)1))2*:3)"'))
{for(ord){$i+=$_&7;grep(vec($s,$i++,1)=1,1..($_>>3)-4);}}print"$s\n";
Reply With Quote
Bookmarks