#!perl
# Figure 19.3: fig19_03.pl
# Another potential security risk: backticks.

use warnings;
use strict;
use CGI qw( :standard );

print( header(), start_html( "Backtick security issue" ) );

my $cgi = new CGI();

unless ( $cgi->param() ) {
   print( "Type some text, then press Enter",
          " and I will display it for you." );
   my $form = new CGI();
   print( $form->startform(),
          $form->textfield( 'words', '', 20 ),
          $form->endform() );
}
else {
   my $words = $cgi->param( 'words' );
   print( "You entered: $words.", br() );
   print( "Attempting to execute: $words.", br() );
   my @matches = `$words`;  
   
   if ( @matches ) {
      print( br(), join( br(), @matches ) );
   }
   else {
      print( "'$words' was not a shell command.", br() ); 
   }
}

print( end_html() );

###########################################################################
#  (C) Copyright 2001 by Deitel & Associates, Inc. and Prentice Hall.     #
#  All Rights Reserved.                                                   #
#                                                                         #
#  DISCLAIMER: The authors and publisher of this book have used their     #
#  best efforts in preparing the book. These efforts include the          #
#  development, research, and testing of the theories and programs        #
#  to determine their effectiveness. The authors and publisher make       #
#  no warranty of any kind, expressed or implied, with regard to these    #
#  programs or to the documentation contained in these books. The authors #
#  and publisher shall not be liable in any event for incidental or       #
#  consequential damages in connection with, or arising out of, the       #
#  furnishing, performance, or use of these programs.                     #
###########################################################################