УЧИМСЯ ПИСАТЬ БЕЗОПАСНЫЕ CGI-СКРИПТЫ

# parse $user_input

$database="$user_input.db";

open(FILE "<$database");

$user=$ARGV[1] # 

if ($user ne "root"){

# осуществить дальнейшие операции }

$file="/etc/passwd\0.txt.whatever.we.want";

die("hahaha! Caught you!) if($file eq "/etc/passwd");

if (-e $file){

open (FILE, ">$file");}

$file="/usr/tmp/.\\./.\\./etc/passwd";

$file=s/\.\.//g;

system("ls -l $file");

$file="/usr/tmp/.\\./.\\./etc/passwd";

open(FILE, "<$file") or die("No such file");

$filename="/safe/dir/to/read/$FORM"

open(FILE, $filename)

$filename="/safe/dir/to/read/$FORM"

if(!(-e $filename)) die("I don't think so!")

open(FILE, $filename)

$filename="/bin/ls /etc\0|"

if(!(-e $filename)) exit;

open(FILE, $filename)

$filename="/bin/ls\0 /etc|"

if(!(-e $filename)) exit;

open(FILE, $filename)

$bug="ls|"

open(FILE, $bug)

open(FILE, "$bug")

# First version 1.1

# Dan Bloomquist dan@lakeweb.net

#This sets the real paths to the html and lock files.

#It is done here, after the POST data is read.

#of the classified page.

$pageurl= $realpath . $DATA{ 'adPath' } . ".html";

$lockfile= $realpath . $DATA{ 'adPath' } . ".lock";

#Read in the classified page

open( FILE,"$pageurl" ) || die "can't open to read 

$pageurl: $!\n";

@lines= ;

close( FILE );

#Send your mail out.

#

open( MAIL, "|$mailprog $DATA{ 'adEmail' }" )

|| die "can't open sendmail: $adEmail: $!\n";

# flexform.cgi

# Written by Leif M. Wright

# leif@conservatives.net

$output = $basedir . $contents{'file'};

open(RESULTS, ">>$output");