0

I would like to execute a command on the server by using the system request parameters in the URL. I am running the server.

In the browser ->> //localhost:9009/?comd which is displaying the list of files in the directory as i placed in the code

if (/comd/i )        { print  $client `dir`;      }

How I can parse the request parameters? For example:

http://localhost:9009/?comd&user=kkc&[email protected]

I would like to return -->> hello user please confirm your email [email protected]

How can I parse the request parameters in the url?

3 Answers 3

4

use CGI;

my $cgi = CGI->new();

my $user = $cgi->param( "user" );
my $mail = $cgi->param( "mail" );

print( "Hello $user please confirm your email $mail\n" );
4
  • 2
    You're not returning a Content-Type header and are not validating the input a user might send. Not validating the input is asking for problems.
    – Htbaa
    Feb 10, 2010 at 15:46
  • 4
    mmm, yummy XSS vulnerabilities.
    – Quentin
    Feb 10, 2010 at 16:20
  • 1
    the question is about how to parse the query string, not how to prevent hacking attemps. If we had to write every time for every question all the code needed to prevent attacks, this website would be useless.
    – Jose Faeti
    Jun 19, 2013 at 13:01
  • @Htbaa I worked with a contractor who claimed, on his CV, to be the "subject matter expert" in Perl at a large city bank in London. He had never heard of Taint Mode. If you were serious about security I'd have expected your first comment to have mentioned Taint Mode. However I'm sure you recognise that I answered the question asked succinctly.
    – PP.
    Jun 20, 2013 at 14:43
3
#!/usr/bin/perl
$|++;                              # auto flush output

use CGI;                           # module that simplifies grabbing parameters from query string
use HTML::Entities;                # for character encoding
use strict;                        # to make sure your Perl code is well formed

print qq{Content-type: text/html\n\n};  # http header b/c outputting to browser

   main();                         # calling the function

   sub main{
      my $cgi    = new CGI;        # store all the cgi variables
      # the following stores all the query string variables into a hash
      #   this is unique because you might have multiple query string values for
      #   for a variable. 
      #   (eg http://localhost/[email protected]&[email protected]&[email protected] )
      my %params = map { $_ => HTML::Entities::encode(join("; ", split("\0", $cgi->Vars->{$_}))) } $cgi->param;

      #Input: http://localhost:9009/?comd&user=kkc&[email protected]
      #Output: Hello kcc please confirm your email [email protected]

      print <<HTML;
      <html>
         <head>
            <style type="text/css">.bold{font-weight:bold}</style>
         </head>
         <body>
            Hello <span class="bold">$params{user}</span> please confirm your email <span class="bold">$params{mail}</span>
         </body>
      </html>
HTML

      return 1;
   }

I hope this helps.

4
  • 3
    See comments about XSS on the answer given 4 months ago.
    – Quentin
    Jun 25, 2010 at 13:12
  • 2
    You're downvoting for that? This is an example and not meant to be the most secure thing ever. Your comment is considered noise.
    – vol7ron
    Jun 25, 2010 at 13:24
  • 2
    Added some encoding, just to get around your XSS nonsense.
    – vol7ron
    Jun 25, 2010 at 13:31
  • Clearly commented codes answer the question of "query string", it deserve up vote. Nov 13, 2012 at 13:42
2
use CGI;
use HTML::Template;

my $cgi = CGI->new;

my $html = qq{
    <!DOCTYPE HTML>
    <html>
    <head><title>Confirmation</title></head>
    <body><p>Hello <TMPL_VAR USER ESCAPE=HTML>. 
    Please confirm your email <TMPL_VAR MAIL ESCAPE=HTML></p></body>
    </html>
};

my $tmpl = HTML::Template->new(scalarref => \$html, associate => $cgi);
print $cgi->header('text/html'), $tmpl->output;

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.