In article <[EMAIL PROTECTED]>,
[EMAIL PROTECTED] (Carl Franks) wrote:
>
> I'm having trouble with a cgi script, the main problem is the snippet below,
> is there anything obvious wrong with it?
>
> if (quotemeta $url =~ /$bad/i) {
> $error = '1';
> }
>
>
> The rest of the code is posted below.
> When I run it (telnet) I get the following error messages:
>
> Use of uninitialized value at ./frameit.cgi line 27.
> Use of uninitialized value at ./frameit.cgi line 32.
> /?/: ?+*{} follows nothing in regexp at ./frameit.cgi line 32.
>
> Basically, it takes a url from GET
> e.g.
> http://www.actualreality.org.uk/cgi-bin/frameit.cgi?http://www.yahoo.com
> and creates a frameset with the url in one frame, and a site banner in the
> other frame.
> It doesn't check whether it's run from the same domain, as it needs to be
> able to be called from a stand-alone program on the users desktop.
> For security, it checks that the url doesn't contain the cgi name or other
> illegal characters @ ` | ?
? is a legal url character
http://my.domain.com/site/cgi-bin/search.cgi?type=map;where=other;item="p
aram1%20param2%20param3"
try encoding the string using CGI.pm's escape functions (see
cgi-docs.html for URI escapes)
--
Scott R. Godin | e-mail : [EMAIL PROTECTED]
Laughing Dragon Services | web : http://www.webdragon.net/
--
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
