Synopsis: Security error in non-parsed header (nph-*) scripts - QUERY_STRING environment variable
State-Changed-From-To: open-closed State-Changed-By: marc State-Changed-When: Wed Nov 12 14:44:51 PST 1997 State-Changed-Why: Your script is what is doing the expansion. The script you give behaves exactly the same way both when done as a nph- script and a non-nph script; both ways it displays the list of files. This is a bug in your script. You either need to disable filename globbing (set -f) or put double quotes around your string. I suspect that if you look again you will find it does happen for non-nph scripts if they are written exactly the same.
