develooper Front page | perl.beginners | Postings from March 2002

Re: Understanding untaint

Thread Previous
From:
merlyn
Date:
March 29, 2002 16:12
Subject:
Re: Understanding untaint
Message ID:
m1it7e6hin.fsf@halfdome.holdit.com
>>>>> "Tom" == Tom Ransom <transom@1bigidea.com> writes:

Tom>      &cl("$DataDir$template_directory$template_name") =~ /(.+)/;
Tom>      my $temp_file = $1;           #keeps nasties from manipulating

Don't ever use $1 without checking the return value of the match.
You might be using the previous $1 instead.  Ick!

-- 
Randal L. Schwartz - Stonehenge Consulting Services, Inc. - +1 503 777 0095
<merlyn@stonehenge.com> <URL:http://www.stonehenge.com/merlyn/>
Perl/Unix/security consulting, Technical writing, Comedy, etc. etc.
See PerlTraining.Stonehenge.com for onsite and open-enrollment Perl training!

Thread Previous


nntp.perl.org: Perl Programming lists via nntp and http.
Comments to Ask Bjørn Hansen at ask@perl.org | Group listing | About