Okay, so security looms over every
webmaster shoulder like...like...like a big scary looming
As we saw in the pre-requisite article
"Introduction to Web Programming 101", there is no such thing as
a full-proof CGI script or a safe web server.
The minute you give the world access to
your inner world is the minute that you introduce security holes.
There is no program web-based or not, that does not introduce a
However, since most webmasters find it
essential to expand their services to include CGI, most webmasters
are ready to take an intelligent risk with their CGI scripts.
In other words, though you can never be
totally safe, you can certainly make yourself as safe as it
In most cases, that means that though a
CGI might get hacked, the hacker could not do much damage.
The first rule of CGI security is to use
one of the standard safe libraries for reading and parsing form
input. These include cgi-lib.pl for Perl 4 and 5 or cgi.pm for
These libraries have been around for
years and have been tested millions of ties by users in every
imaginable environment. They have gone through many revisions
from learned experience and take precautions for all sorts of
little buggers that you may not think about if you started
writing a form handler yourself.
However, once you have read and parsed
form data, you must also pay attention to how that data is used
and make sure that you do not create a security hole in the data
There are two primary considerations for
writing safe CGI scripts as discussed by Lincoln Stein in his
SafeCGI presentation available at
http://www-genome.wi.mit.edu/~lstein/. These are checking user
input and restricting system calls.