In reading over the node, Executing a function on submit, I realized that one of my coding practices has some potential security risks.

Instead of retrieving the value of parameter values on an as-needed basis, I quite typically dump the entire contents of param() to scalars, as in:

use strict;
use warnings;
use CGI;
my $q = new CGI;
@names = $q->param;
foreach $name(@names){
    $$name=$q->param($name);
    #print $name, ': ', $$name, '<BR>';
}
[download]

So any form field in the HTML file automatically becomes a Perl var in the cgi script when the form is submitted.

After spending some time on this site, it occurs to me that some unscrupulous but savvy user could quite easily break a program by "hijacking" my form, i.e. downloading a local copy and modifying the field names in the form and changing the ACTION statement to a fully qualified URI.

How ruined would my day be if the following were submitted?:

<FORM METHOD=POST ACTION="http://mydomain.com/cgi-bin/search.cgi">
<INPUT TYPE='text' name='a'>
<INPUT TYPE='text' name='b'>
<INPUT TYPE='text' name='/'>
<INPUT TYPE='text' name='\'>
<INPUT TYPE='text' name='!'>
<INPUT TYPE='text' name='_'>
</FORM>
[download]

I understand that a lot depends on the particulars of my script, but my generalized question is is my concern warranted or is there some sort of built in security measure in CGI.pm to handle reserved variable names? If my concern is warranted, has anyone out there come up with a bullet proof way of dealing with this?

I've read over the CGI docs and can't find anything related to this topic. (??)