Idiots Guide to CGI in
Perl
Q + A
Tom Christiansen
Q: Who owns the
script?
A: I do.
Q: What are the script's permissions?
A: They were 0600, but I just realized
that's not executable. I'd better make it 0755 instead.
Q: Is your script in the right directory?
A: No, I forgot to put it in
/usr/local/etc/httpd/cgi-bin/.
Q: Is CGI execution enabled in your server for that
directory and/or file suffix?
A: No, my sysadmin
forgot to configure it that way; he thought that GET
would be enough, and didn't include POST
capabilities.
Q: Under what uid does the server runs its CGI
programs?
A: wwwuser (Oops, it can't write
my files or directories.)
Q: Can the server's uid write any files you're
trying to write?
A: Nope - I own the files, but it
doesn't run as me and the permissions are 0600 instead of
0666. I guess that's why it can't open my own files.
Q: What happens when you run it interactively?
A: I didn't know you could run these interactively
because I never bothered to read the documentation for the CGI.pm
library.
Q: What's in the server error log?
A: I never thought to look. Oh, there it is - never
mind.
Q: Where's the server log?
A: (No
way to know - it's system dependent. Check with your admin if you
can't find it in /usr/local/etc/httpd/logs/error_log)
Q: What's the Perl version and OS version?
A: Perl version 5.002, SunOS version 4.1.3
(Try
using perl -v and uname -a to find out, and if
your Perl is below 5.002 in version, UPGRADE
NOW! )
Q: What's the library version?
A:
grep -i version in the library, or for CGI.pm, do this:
- $ perl -le 'use CGI; print $CGI::VERSION'
2.21
Q: What's the path to your perl executable on the
server?
A: /contrib/bin/perl
Q: What's the path to your perl executable specified
in your script?
A: /usr/bin/perl (oops, of
course it can't find it)
Q: What's the http daemon server's version number so
people who might help you have a better clue about your local
environment?
A: NCSA 1.5
Q: What happens when you add Perl's -w
flag?
A: It tells me about my silly mistakes that
are listed in detail in the perldiag
manpage where I diligently looked them up.
Q: What happens when you add Perl's -T
flag?
A: It tells me about security problems as
described in the perlsec
manpage, which I've carefully read and understood. I even read the
CGI
Security FAQ.
Q: What happens when you add use strict?
A: It makes me declare my variables and quote my
strings and finds all these silly errors which I've carefully
corrected using my() declarations, use vars, and
quotes.
Q: Did you remember to output the
MIME type before any other non-header output
(other headers might be Location: or Set-Cookie:)
A: Oh, right. It has to be a valid header and
then a valid body. I guess I need to say this stuff earlier
than I was doing: and make sure I actually put two newlines out, not
just one.
print "Set-cookie: GroversDelight ";
print "Content-Type:
text/html ";
# <-- two newlines print
"<HEAD><TITLE>Sample Title</TITLE></HEAD>
";
Q: Did you remember to flush STDOUT at the
top of your script so the MIME type gets out before
any errors?
A: Nope - gosh, no wonder it doesn't get out
before it bombs! I guess I better add this to the top:
- $| = 1
Q: What happens when you check return values of
each and every one of your syscalls?
A: That
seems like way too much work, but sure enough, just as soon as I
added something like
-
open(FILE, ">some_file") || die("can't write
some_file: $!");
the error log showed that
$! contains ``Permission denied'' or ``No such file or
directory'', and everything became clear.
Q: Did you use the standard CGI.pm module to do this
for you instead of parsing by hand (which would be a really idiotic
idea) or use the more limited cgi-lib.pl library?
A: Gee, you mean somebody else has actually done
this kind of thing before? I had no idea I didn't know I didn't have
to do it all myself, and and that I could get the latest version of
the neat CGI module from http://www.perl.com/cgi-bin/cgi_mod?modules=CGI.
Q: If you used a library, did you type make
install to place it in the proper system directory (somewhere
in @INC, probably a lot like
/usr/local/lib/perl/site_perl/CGI.pm) so it can be properly
found and have its set permissions to 0644, or did you just
blindly do a manual copy and screw up the path, permissions, or
both?
A: What's make? Look, like I just
(mis)installed it myself by a silly copy to cgi-bin and then I made
it mode 0700. I guess that doesn't work at all, does it?
Q: Did you remember to post to
comp.infosystems.www.authoring.misc, instead of blasting the
comp.lang.perl.* groups with questions that aren't related to Perl
in the least?
A: Nope - is that why I don't get any
useful answers but just a bunch of flames instead?
Q: If you're running some brain-dead,
bondage-and-discipline pseudo-operating system from The Evil Empire,
did you bother to read what the Windoze Perl FAQ says about the Web?
A: No, I didn't know about the Perl for
Win32 FAQfrom Evangelo Prodromou.
Q: Did you avoid placing an interpreter in your
cgi-bin the way you're warned about at http://www.perl.com/perl/news/latro-announce.html
and from CERT?
A: No, what's wrong
with that (noise of disk grinding to dust after corporate secrets
stolen heard in the background)?
Next: Summary »
Skip
Ahead
1 Introduction
2
Q +
A
3 Summary
.gif){kind=small}
