Re: [MacPerl-WebCGI] Too late for '-T' error message

[email protected] Wed, 24 Jul 2002 23:48:33 EDT
Newsgroups perl.macperl.webcgi
Message-ID <[email protected]>
>>Nope. That's the shebang line. Well, it's also called other things, but
it is _not_ the command line.<<

Thanks I forgot that soon. Not used to it yet.

>>I'm going to tell you how to shoot yourself in the foot. You can simply
drop the "-T" from the shebang line, and Perl will simply not warn you
if your program tries to use (potentially) tainted data, so you can also
learn bad programming habits.<<

It doesn't like that. Whole new problem. The guy wrote a strict script. Here 
is the error without -T or even -w as well.

Can't find string terminator "EndOfText" anywhere before EOF at 
C:\Inetpub\scripts\guestbook5\czguests.cgi line 168.

>>You might try syntax checking your scripts
from the DOS command line, specifying the -T option there, and that will
at least give you some warnings.<<

I know DOS but not with script checking yet. Only a few commands like perl -v 

perl [space whatever]

>>BTW, if the problem with on-line time is money, it's probably cheaper in
the long run to just get on line anyway. You'll learn a lot more.<<

I have unlimited online time but my time on line is limited. And I have 
learned and done more than I care to mention. 

>>In MS servers, if you are running with the -T option, you need to setup
different file associations.  In other words, #! /perl just runs perl,
and is associated with the .pl file extension, i.e., .pl is associated
with the command 'c:\path_to_perl\perl.exe'.  You need to add something
like a .tpl file extension to run 'c:\path_to_perl\perl.exe -T', then
rename any files that need to run with taint mode to have a .tpl extension.<<

>>Of course, this is something that I ran across sometime ago, so it would
probably be beneficial to run a Google search on this to get more information<

<

Interesting but will this be the same concept to use with my online host? 
They have the latest perl version there.

>>To sort things out:
Microsoft servers don't care about the shebang strings.
IIS goes by file extensions. The association of '.pl'
with perl.exe is set up in the IIS configuration.
Specifically, there is a line that looks something
like: 'perl.exe %s %s'. The first %s is replaced with
your script name, the second with the parameters.
This is where (I think), you can include the -T switch:
'perl.exe -T %s %s'. Then all the '.pl' scripts served by 
IIS will be invoked in the taint mode.
Again, the above is only true for IIS, not Apache.
Eugene Haimov<<

Eugene the script does not contain that code you mentioned.

Thanks guys
Dave