Beefy Boxes and Bandwidth Generously Provided by pair Networks
Think about Loose Coupling
 
PerlMonks  

Re: •Re: Re: •Re: making first letter of all words in array upper case

by agentv (Friar)
on Dec 31, 2002 at 21:42 UTC ( [id://223477]=note: print w/replies, xml ) Need Help??


in reply to •Re: Re: •Re: making first letter of all words in array upper case
in thread making first letter of all words in array upper case

start by reading and understanding every relevant CGI security document you can find.

I don't know if you meant that as a joke or not. There were 1.8 million documents returned by that search!

So are you saying that before someone writes a CGI script that sends mail, they should start by reading 1.8 million web documents as a prerequisite?

You know, one of the things I took from the most obvious writings about Perl in its early days was the philosophy that you don't have to "know all about it" in order to get things done with Perl. It is not considered necessary to rise to some high level of mastery before starting. It is meet to restrain oneself from certain courses of action when there is the risk of damage or extreme annoyance as a result of your programming efforts.

But in this case, I feel that the danger is significantly overstated. The chance of a major spam offender finding some sleepy website with a homemade "tell your friends script" and coercing that to further pollute the world at top speed seems remote to me. (No offense iamrobj, I haven't actually looked at your web site, I'm making a guess here.)

To answer your question further on in the thread iamrobj, it's not too hard to "sanitize" your script. One simple discussion in the Perl Cookbook (recipe 19.4 "Writing a Safe CGI Program) can get you on your way. Just be sure to test the data that is submitted for any message headers for illegal characters, and if you want to be very diligent, maybe you could read up on how to have your script probe the From: address to see if it truly exists.

In the end, don't let discouragement from others freeze you into inactivity. Just let it serve as a warning that you may need to be careful about certain things, because it is true that putting up a CGI script allows others to utilize your computing facility. (or that of your ISP) So think everything through and ask around about potential risks. But definitely keep on coding!

...All the world looks like -well- all the world, when your hammer is Perl.
---v

  • Comment on Re: •Re: Re: •Re: making first letter of all words in array upper case

Replies are listed 'Best First'.
Re: Re: •Re: Re: •Re: making first letter of all words in array upper case
by davorg (Chancellor) on Dec 31, 2002 at 23:02 UTC
    You know, one of the things I took from the most obvious writings about Perl in its early days was the philosophy that you don't have to "know all about it" in order to get things done with Perl. It is not considered necessary to rise to some high level of mastery before starting. It is meet to restrain oneself from certain courses of action when there is the risk of damage or extreme annoyance as a result of your programming efforts.

    This is true of Perl. But we're not just talking about Perl. We're talking about CGI. The problems that merlyn is talking about have nothing to do with Perl, they are all about CGI. They would be the same in any language that you chose to implement your CGI program.

    From a security point of view, putting a CGI program on a public web server is one of the most dangerous things you can do. You do need to understand all the security implications. Writing a Perl program is easy. You don't need to know how everything works in order to get your program running. But writing a CGI program is a completely different ball game. I really don't understand why there are so many books written that encourage people with no experience in programming to write CGI programs. It's a recipe for disaster.

    --
    <http://www.dave.org.uk>

    "The first rule of Perl club is you do not talk about Perl club."
    -- Chip Salzenberg

Log In?
Username:
Password:

What's my password?
Create A New User
Domain Nodelet?
Node Status?
node history
Node Type: note [id://223477]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this?Last hourOther CB clients
Other Users?
Others scrutinizing the Monastery: (2)
As of 2024-04-19 22:16 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    No recent polls found