ch19_04.htm

By Tom Christiansen and Nathan Torkington ISBN 1-56592-243-3 First Edition, published August 1998

CLASS="replaceable"
><I
>number=10</I
></CODE
></B
></CODE
>
<CODE
CLASS="userinput"
><B
><CODE
CLASS="replaceable"
><I
>^D</I
></CODE
></B
></CODE
>

% perl -w  cgi-script name=joe number=10    # run with mock form input
% perl -d  cgi-script name=joe number=10    # ditto, under the debugger

# POST method script in csh
% (setenv HTTP_METHOD POST; perl -w cgi-script name=joe number=10)
# POST method script in sh
% HTTP_METHOD=POST perl -w cgi-script name=joe number=10</PRE
><P
CLASS="para"
>Check the server's error log. Most web servers redirect CGI process's STDERR into a file. Find that file (try <I
CLASS="filename"
>/usr/local/etc/httpd/logs/error_log</I
>, <I
CLASS="filename"
>/usr/local/www/logs/error_log</I
>, or just ask your administrator) and see whether any warnings or error messages are showing up there.</P
><P
CLASS="para"
>Are you using an old version of Perl? Type <EM
CLASS="emphasis"
>perl -v</EM
> to find out. If you're not using 5.004 or better, you or your admins should upgrade, because 5.003 and earlier releases were not protected against buffer overruns. This is a grave security matter.</P
><P
CLASS="para"
>Are you using an old version of the libraries? You can either <EM
CLASS="emphasis"
>grep -i version</EM
> in the library file (probably in <I
CLASS="filename"
>/usr/lib/perl5/</I
>, <I
CLASS="filename"
>/usr/local/lib/perl5</I
>, <I
CLASS="filename"
>/usr/lib/perl5/site_perl</I
>, or some such). For CGI.pm, and in fact, with any module, you can do this to figure out which version you're using:</P
><PRE
CLASS="programlisting"
>% perl -MCGI -le 'print CGI-&gt;VERSION'
<CODE
CLASS="userinput"
><B
><CODE
CLASS="replaceable"
><I
>2.49</I
></CODE
></B
></CODE
></PRE
><P
CLASS="para"
>Are you running the latest version of your web server? It's not often that it happens, but sometimes a web server has bugs that can interfere with your scripts.</P
><P
CLASS="para"
>Are you running with the <B
CLASS="emphasis.bold"
>-w</B
> switch? This makes Perl gripe about things like using uninitialized variables, reading from a write-only filehandle, and so on.</P
><P
CLASS="para"
>Are you running with the<B
CLASS="emphasis.bold"
> -T</B
> flag? If Perl complains about insecure actions, you might be assuming things about your script's input and environment that aren't true. Make it taint-clean (read <A
CLASS="xref"
HREF="ch19_05.htm"
TITLE="Writing a Safe CGI Program"
>Recipe 19.4</A
>, see the <EM
CLASS="emphasis"
>perlsec</EM
> manpage to find out about tainting and its consequences for your program, and check the CGI Security FAQ for particular web traps to avoid) and you may sleep easier at night as well as have a working script.</P
><P
CLASS="para"
>Are you running with <CODE
CLASS="literal"
>use</CODE
> <CODE
CLASS="literal"
>strict</CODE
>? It makes you declare variables before you use them and quote your strings to avoid any confusion with subroutines, and in doing so finds a lot of errors.</P
><P
CLASS="para"
>Are you checking the return values of each and every one of your system calls? Many people blindly believe that every <CODE
CLASS="literal"
>open</CODE
> or <CODE
CLASS="literal"
>system</CODE
> or <CODE
CLASS="literal"
>rename</CODE
> or <CODE
CLASS="literal"
>unlink</CODE
> in their programs will work all the time. These functions return a value so you can find out whether they worked or not&nbsp;- check them!</P
><P
CLASS="para"
>Can Perl find the libraries you're using? Write a small script that just prints <CODE
CLASS="literal"
>@INC</CODE
> (Perl's array of directories it looks for modules and libraries in). Check the permissions on the libraries (they must be readable by the user the script runs as). Don't try to copy modules from one machine to another&nbsp;- a lot of them have compiled and autoloaded components hidden away in the Perl library directory. Install them yourself from scratch.</P
><P
CLASS="para"
>Is Perl giving you warnings or errors? Try using CGI::Carp (see <A
CLASS="xref"
HREF="ch19_03.htm"
TITLE="Redirecting Error Messages"
>Recipe 19.2</A
>) to send Perl's error messages and warnings to the browser or a file you have access to.</P
></DIV
><DIV
CLASS="sect3"
><H4
CLASS="sect3"
><A
CLASS="title"
NAME="ch19-pgfId-1000005217"
>Is the script upholding its end of the CGI protocol?</A
></H4
><P
CLASS="para"
>The HTTP header must come before the text or image you return. Don't forget the blank line between the header and body. Also, because STDOUT is not automatically autoflushed but STDERR is, if your script generates warnings or errors to STDERR the web server might see them before it sees your HTTP header and can generate an error on some servers. Add this at the top of your script (after the <CODE
CLASS="literal"
>#!</CODE
> line) to also flush STDOUT:</P
><PRE
CLASS="programlisting"
>$| = 1;</PRE
><P
CLASS="para"
>Don't ever try to decode the incoming form data by parsing the environment and standard input yourself. There are just too many places where it can go wrong. Use the CGI module and spend your time writing cool programs or reading Usenet instead of tracking down bugs in your implementation of an arcane protocol.</P
></DIV
><DIV
CLASS="sect3"
><H4
CLASS="sect3"
><A
CLASS="title"
NAME="ch19-pgfId-1000005225"
>Asking for help elsewhere.</A
></H4
><P
CLASS="para"
>Check the FAQs and other documents mentioned at the end of the Introduction to this chapter. There is still a chance that you have made a common mistake on whatever system you're using&nbsp;- read the relevant FAQs to make sure you don't embarrass yourself by asking the CGI equivalent of "why doesn't my car run when it's out of gas and oil?"</P
><P
CLASS="para"
>Ask a friend. Almost everyone knows somebody they can ask for help. You'll probably get a reply much sooner than if you asked the Net.</P
><P
CLASS="para"
>Post to <CODE
CLASS="literal"
>comp.infosystems.www.authoring.misc</CODE
> if your question is about a CGI script (the CGI module, decoding cookies, finding out where the user is coming from, etc.).<A
CLASS="indexterm"
NAME="ch19-idx-1000005402-0"
></A
><A
CLASS="indexterm"
NAME="ch19-idx-1000005402-1"
></A
><A
CLASS="indexterm"
NAME="ch19-idx-1000005402-2"
></A
><A
CLASS="indexterm"
NAME="ch19-idx-1000005402-3"
></A
></P
></DIV
></DIV
><DIV
CLASS="sect2"
><H3
CLASS="sect2"
><A
CLASS="title"
NAME="ch19-pgfId-340"
>See Also</A
></H3
><P
CLASS="para"
><A
CLASS="xref"
HREF="ch19_03.htm"
TITLE="Redirecting Error Messages"
>Recipe 19.2</A
>; the discussion on buffering in the introduction of <A
CLASS="xref"
HREF="ch08_01.htm"
TITLE="File Contents"
>Chapter 8, <CITE
CLASS="chapter"
>File Contents</CITE
></A
>; the CGI FAQ at <A
CLASS="systemitem.url"
HREF="http://www.webthing.com/tutorials/cgifaq.html"
>http://www.webthing.com/tutorials/cgifaq.html</A
></P
></DIV
></DIV
><DIV
CLASS="htmlnav"
><P
></P
><HR
ALIGN="LEFT"
WIDTH="684"
TITLE="footer"><TABLE
WIDTH="684"
BORDER="0"
CELLSPACING="0"
CELLPADDING="0"
><TR
><TD
ALIGN="LEFT"
VALIGN="TOP"
WIDTH="228"
><A
CLASS="sect1"
HREF="ch19_03.htm"
TITLE="19.2. Redirecting Error Messages"
><IMG
SRC="../gifs/txtpreva.gif"
ALT="Previous: 19.2. Redirecting Error Messages"
BORDER="0"></A
></TD
><TD
ALIGN="CENTER"
VALIGN="TOP"
WIDTH="228"
><A
CLASS="book"
HREF="index.htm"
TITLE="Perl Cookbook"
><IMG
SRC="../gifs/txthome.gif"
ALT="Perl Cookbook"
BORDER="0"></A
></TD
><TD
ALIGN="RIGHT"
VALIGN="TOP"
WIDTH="228"
><A
CLASS="sect1"
HREF="ch19_05.htm"
TITLE="19.4. Writing a Safe CGI Program"
><IMG
SRC="../gifs/txtnexta.gif"
ALT="Next: 19.4. Writing a Safe CGI Program"
BORDER="0"></A
></TD
></TR
><TR
><TD
ALIGN="LEFT"
VALIGN="TOP"
WIDTH="228"
>19.2. Redirecting Error Messages</TD
><TD
ALIGN="CENTER"
VALIGN="TOP"
WIDTH="228"
><A
CLASS="index"
HREF="index/index.htm"
TITLE="Book Index"
><IMG
SRC="../gifs/index.gif"
ALT="Book Index"
BORDER="0"></A
></TD
><TD
ALIGN="RIGHT"
VALIGN="TOP"
WIDTH="228"
>19.4. Writing a Safe CGI Program</TD
></TR
></TABLE
><HR
ALIGN="LEFT"
WIDTH="684"
TITLE="footer"><FONT
SIZE="-1"
></DIV<!-- LIBRARY NAV BAR --> <img src="../gifs/smnavbar.gif" usemap="#library-map" border="0" alt="Library Navigation Links"><p> <a href="copyrght.htm">Copyright &copy; 2002</a> O'Reilly &amp; Associates. All rights reserved.</font> </p> <map name="library-map"> <area shape="rect" coords="1,0,85,94" href="../index.htm"><area shape="rect" coords="86,1,178,103" href="../lwp/index.htm"><area shape="rect" coords="180,0,265,103" href="../lperl/index.htm"><area shape="rect" coords="267,0,353,105" href="../perlnut/index.htm"><area shape="rect" coords="354,1,446,115" href="../prog/index.htm"><area shape="rect" coords="448,0,526,132" href="../tk/index.htm"><area shape="rect" coords="528,1,615,119" href="../cookbook/index.htm"><area shape="rect" coords="617,0,690,135" href="../pxml/index.htm"></map> </BODY
></HTML
>