PERL CGI Beginners - CGI parameters

Author

CGI parameters

Dermot Paikkos

2005-10-24, 6:55 pm

Hi,

I am trying to access the parameter list from a form. I keep getting
a "Not an ARRAY reference at (eval...)". The error seems to refer to

my @names = $q->param;

If I use Dump I get:

# imp
* list.txt
# dsc
* Groovey
*
# set
*
# usr
* DP
# job
* jobs/DP227
# go
* Y
# DUF

I think there is some odd characters or something after Groovey. The
form has a file upload button and I expect that this might be the
source of the problem. There is a file being uploaded when I am
getting the above error.

So I tried fetching all the parameters into a hash but I keep hitting
other problems; "can't use bareword Vars with strict" and the hash
reference looks empty.

What is the best way to slurp up the field values from a form?
How can I enable strict and use barewords like Vars?
What am I doing wrong with my hash reference ($q->Vars doesn't work
either)?

Below is a edited version, I have been trying some lots of variation
to get it to work but alas nada. All I want to do is slurp up the
text file being uploaded (not shown below), leave it in /tmp, then
forward the whole process to another program with all the original
field data intact.
Thanx in advance.
Dp.

==============
#!/usr/bin/perl -w

use strict;

use CGI qw\standard cgi-lib\;
use CGI::Carp qw(fatalsToBrowser);

$CGI::POST_MAX = 1024 * 1000; # Set limit to 1MB

my $q = new CGI;

my @names = $q->param;
my $params = Vars;

my $len = @{$params};

print $q->header(-type=>'text/html',
-charset=>'iso-8859-1',
);
print $q->start_html(
-BGCOLOR => '#777777',
-script =>{-language => 'JAVASCRIPT',
-src => 'http://austin/iptc.js'},
# -onLoad => "$jscript",
-style =>{-src=>'http://austin/css/iptc-
meta.css'},
);
print $q->h1("Greetings");
print "Ref is $len";
print $q->Dump;

print $q->start_form(-method => 'post',
-action => 'http://austin/cgi-bin/dwsrun?PXEXI.DWO',
-name => 'myform',
);
foreach my $p (@names) {
my $v = $q->param($p);
print $q->hidden(-name=>$p,
-default=>$v,
);
print "$p, "
}

print end_html;
=====================

Ovid

2005-10-24, 6:55 pm

--- Dermot Paikkos <dermot@sciencephoto.com> wrote:

> Hi,
>
> I am trying to access the parameter list from a form. I keep getting
> a "Not an ARRAY reference at (eval...)". The error seems to refer to
>
> my @names = $q->param;

I suspect you're off by a couple of lines:

my @names = $q->param;
my $params = Vars;

my $len = @{$params}; # $params should be a hashref

Vars() returns a hashref, not an array ref. Also, if you're going
through the trouble of fetching the param() list, why use Vars? Vars
is to provide compatability with old cgi-lib scripts. Becuase it
separates values with null bytes, you run the risk of exposing you code
to a security hole known as the "null byte hack". I explain the latter
in lesson three of my CGI course:
http://users.easystreet.com/ovid/cg...sson_three.html

Cheers,
Ovid

--
If this message is a response to a question on a mailing list, please send
follow up questions to the list.

Web Programming with Perl -- http://users.easystreet.com/ovid/cgi_course/

Dermot Paikkos

2005-10-25, 7:55 am

On 24 Oct 2005 at 11:48, Ovid wrote:

>
> I suspect you're off by a couple of lines:
>
> my @names = $q->param;
> my $params = Vars;
>
> my $len = @{$params}; # $params should be a hashref
>
> Vars() returns a hashref, not an array ref.
Dohh. Yes reading that paragraph more clearly now. I guess I need a
slice of the hash ref??

I still get the error if I remove those lines:
1 #!/usr/bin/perl -w
2
3 use strict;
4
5 use CGI qw\standard cgi-lib\;
6 use CGI::Carp qw(fatalsToBrowser);
7
8 $CGI::POST_MAX = 1024 * 1000; # Set limit to 1MB
9
10
11 my $q = new CGI;
12
13 my @names = $q->param;
14 #my $params = Vars;
15 #my $len = @{$params};
.....snip

Software error:

Not an ARRAY reference at (eval 33) line 12.

If I do it the other way:
3 #use strict;
4
5 use CGI qw\standard cgi-lib\;
6 use CGI::Carp qw(fatalsToBrowser);
7
8 $CGI::POST_MAX = 1024 * 1000; # Set limit to 1MB
9
10
11 my $q = new CGI;
12
13 #my @names = $q->param;
14 my $params = Vars;
15 my $len = @{$params};
....snip

It runs without error.

So I am not sure why the param list is failing - I have to suspect
that it is the content of the file upload as it works if I pass the
script a url type string on the command line.

Becuase it
> separates values with null bytes, you run the risk of exposing you code
> to a security hole known as the "null byte hack". I explain the latter
> in lesson three of my CGI course:
> http://users.easystreet.com/ovid/cg...sson_three.html

Wasn't aware of this. The script, as I said, tries to deal with a
file upload so the taint part of this articles is very helpfully

I only tried to use Vars because I was failing to fetch the param
list with $q->param. It was just another way of tring to get the
params but I obviously have some work to do there.
> Cheers,
> Ovid
Thank you.

Don't supose you have any suggestion on how to create a hash slice of
the input field names??

Ovid

2005-10-25, 6:55 pm

--- Dermot Paikkos <dermot@sciencephoto.com> wrote:

> I still get the error if I remove those lines:
> 1 #!/usr/bin/perl -w
> 2
> 3 use strict;
> 4
> 5 use CGI qw\standard cgi-lib\;
> 6 use CGI::Carp qw(fatalsToBrowser);
> 7
> 8 $CGI::POST_MAX = 1024 * 1000; # Set limit to 1MB
> 9
> 10
> 11 my $q = new CGI;
> 12
> 13 my @names = $q->param;
> 14 #my $params = Vars;
> 15 #my $len = @{$params};
> ....snip

OK, there is something else going on here. Previously I saw that you
were importing things incorrectly, but I didn't say anything as Lincoln
Stein has done enough strange things with CGI.pm to get it to *just
work*. Now I'm pointing this out because it's likely related.

First, I can't imagine how your code is functioning at all because you
have not imported Vars. For example, the following minimal test script
will demonstrate the problem:

#!/usr/bin/perl

use strict;
use warnings;

use CGI qw\standard cgi-lib\;
my $params = Vars;

That will complain about the bareword "Vars".

That gets fixed with this:

use CGI qw(:standard :cgi-lib);

Second, please do not use backslashes '' as quote operators. They're
very visually jarring to most and if you use them, you'll find it
difficult to escape any special characters you've quoted. In fact, in
my years of using Perl, I've used backslashes for this purpose once.
It was a deliberate joke.

Third, if you are instantiating a new CGI object with CGI->new, you do
not need to use ":standard" in your import list. ":standard" is for
importing the most common CGI functions into your namespace (such as
"param", "header", etc.). When using the object oriented CGI interface
(CGI->new) this is not necessary.

use CGI;
my $cgi = CGI->new; # "new CGI", though documented,
# is not recommended
my @params = $cgi->param;
print $cgi->header('text/plain');
foreach my $name ( @params ) {
# assumes single value params
print "$name: " . $cgi->param($name) . "\n";
}

Versus:

use CGI qw(:standard);

print header('text/plain');
foreach my $name ( param() ) {
# assumes single value params
print "$name: " . param($name) . "\n";
}

Which style you prefer will depend upon your needs and tastes.

Cheers,
Ovid

--
If this message is a response to a question on a mailing list, please send
follow up questions to the list.

Web Programming with Perl -- http://users.easystreet.com/ovid/cgi_course/

Sponsored Links