"Paul Johnson" <[EMAIL PROTECTED]> wrote in message
[EMAIL PROTECTED]">news:[EMAIL PROTECTED]...
> On Thu, Jan 30, 2003 at 03:25:00PM -0700, Westgate, Jared wrote:
>
> > Warning: opinionated text follows, so please don't take offense :)
>
> I didn't see anything from which anyone should take any offence, unless
> you were talking about the length of your lines :-)
>
> > In fact, I occasionally find myself frustrated with the brevity of
> > many responses to people's questions.  I think a lot of people are
> > using this list to learn, not just to be told what to do.  I'm not
> > saying to write a novel out of each response, but a little detail can
> > be nice.  You have to remember, a lot of people who are learning Perl
> > (and even many who are learning English) are using this list.
>
> Whilst I don't disagree with anything you say, you also have to remember
> that a lot of people who frequently reply to messages are very busy and
> may not have the time to go into details which may or may not have been
> required.

Thank you. I've got the spec to cite, but I couldnt look it up yesterday.
This shouldn't mean I have to sit by and watch somone recommend another use
some abhorrently bad code.

On the subject of:

 >       @in = split(/&/,$in);

Its not the syntax or logic that is bad. It's the implementation.

here is a section of the html 4 spec:
http://www.w3.org/TR/html4/appendix/notes.html#ampersands-in-uris

B.2.2 Ampersands in URI attribute values
The URI that is constructed when a form is submitted may be used as an
anchor-style link (e.g., the href attribute for the A element).
Unfortunately, the use of the "&" character to separate form fields
interacts with its use in SGML attribute values to delimit character entity
references. For example, to use the URI "http://host/?x=1&y=2"; as a linking
URI, it must be written <A href="http://host/?x=1&#38;y=2";> or <A
href="http://host/?x=1&amp;y=2";>.

We recommend that HTTP server implementors, and in particular, CGI
implementors support the use of ";" in place of "&" to save authors the
trouble of escaping "&" characters in this manner.

In other words, an & is used in SGML (of which html is an application) to
delimit character entity references so we shouldnt be using it when not
referring to entity references. This is not to say it dosent happen, as
sometime awhile ago a & got used to seperate name/value pairs. Thats not
going to change any time soon. But there are servers and clients that obey
this part of the spec and use a ';' to delimit their namve/value pairs.

so when my compliant client sends:

GET /cgi-bin/yourprog.cgi?param1=val1;param2=val2 HTTP/1.1

its going to crash, or worse yet, run but not do what you want it to do.

The current version of CGI.pm uses:

 my(@pairs) = split(/[&;]/,$tosplit);

Now to get back on the topic of perl, this is only one of the problems with
that parser. As has been pointed out, its easy to build an implementation of
a specification and miss something. Thats why you should always use a
module.

Im not promising modules are bug free, thats impossible. But the odds are
pretty good that a CPAN module will have one less bug than a roll-your-own
solution.

Todd W.



-- 
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]

Reply via email to