Security Issue needing correcting

[Susan]

Hi
I created a script that would take the online form data and fill in the data onto a 
word.doc form keeping it perfectly formatted, and then emailing the completed word.doc 
form to the email address.  Though I am concerned that a malious macro could be 
implanted or that it is not secure enough and would like to fix that part.  If anyone 
knows how to do this, that would be great.  Here is the word.pl that has the script... 
Thanks so much...
Susan
*******SCRIPT*******SCRIPT*******SCRIPT*******SCRIPT*******SCRIPT*******SCRIPT*******
#!/usr/local/bin/perl 
# word.pl

use strict;
use CGI ':standard';

my $q = new CGI;
my $debug_flag =    0;  # 1 if debugging, otherwise 0
my $email_to =     "email\@email.net";
my $email_from = $q->param('Email...................................');
my $email_subject = "Employment Application";
my $email_message = "\n Attached is an application for employment from " . 
$q->param('FirstName................') . " " . $q->param('LastName.................') 
. " generated from the online web form."; 
my $thank_you_url = http://www.url.com/thankyou.html";;
my $input_file =    "application0.doc";
my $output_file =   "/usr/local/lib/httpd/cgi-bin/folder/application.doc";

my $file_contents = "";  # read the entire word document into one big string
my @cgi_parameters = $q->param;   # array of all cgi parameters
my $name = "";           # the name part of the name/value cgi pair
my $value = "";          # the value part of the name/value cgi pair

# This the Content Header in case error messages or debugging.
#
print $q->header, title("Application for Employment web program");
if ($debug_flag) {
   print "\n<H1 align=center>Thank you</H1>";
   #print "Test:";my @a=sort $q->param; foreach $_ (@a) {print 
"\n<BR>$_=".$q->param("$_");}
}



# Read the entire word document into one big string
#
if (open (FH, $input_file)) {
   print "\n<BR>Opening $input_file" if $debug_flag;
   while (<FH>) { $file_contents .= $_; }
   close (FH);
} else {
   print " Can not open $input_file";
   exit;
}



# Replace the markers in the word document with the CGI values 
#
foreach $name (@cgi_parameters) {
   $value = $q->param("$name");
   if ($file_contents =~ /$name/) {
      if (length $name > length $value) {
         # pad the value with a nonprintable character chr(31)
         $value = $value . chr(31) x ((length $name)-(length $value));
      }
      if (length $name < length $value) {
         print "\n<BR> --> Error: The length of name \"$name\" < the length of its 
value \"$value\". The Word Doc would not be recognized, so this name will not be 
replaced with its value.";
      } else {
         print "\n<BR> Replacing $name with \"$value\"" if $debug_flag;
         $file_contents =~ s/$name/$value/;
      }
   } else {
      print "\n<BR>--> Did not find a parameter named \"$name\". Ignoring its value 
\"$value\"";
   }
}



# Save the completed word document
#
if (open (FH, ">$output_file")) {
   print "\n<P>Saving $output_file" if $debug_flag;
   print FH $file_contents;
   close (FH);
} else {
   print "\n<P> Can not save $output_file";
   exit;
}

&email_it ($email_to1) if $email_to;

# Go to the Thank-You URL
#
print "\n<META HTTP-EQUIV=Refresh CONTENT='2; URL=$thank_you_url'>";
exit (0);



sub email_it {
##################################################################
#
# Mail the $file_contents as an attachment
#
##################################################################
my $email = shift;

 print "\n\n<P>Emailing $output_file to $email" if $debug_flag;
 use MIME::Entity;

 # Create the top-level, and set up the mail headers:
 my $top = build MIME::Entity Type     => "multipart/mixed",
      -From    => $email_from,
      -To      => $email,
      -Subject => $email_subject;

 # Attachment #1: some literal text:
 attach $top  Data=>$email_message;

 # Next Attachment: The Word string
 attach $top  Path        => $output_file,
       Type        => "application/msword",
       Encoding    => "base64";

 # Send it:
 if (open MAIL, "| /usr/lib/sendmail -t -i") {
    $top->print(\*MAIL);
    close MAIL;
 } else {
    print "\n<P> Can not open sendmail program: $!";
    exit;
 }
}

*******ENDSCRIPT*******ENDSCRIPT*******ENDSCRIPT*******ENDSCRIPT*******ENDSCRIPT*******ENDSCRIPT*******