#!/usr/bin/perl # pizza5submit.cgi # handles pizza5.cgi order completion form # get form data $input=untaint(); # Read from stdin and untaint it chomp($input); chomp($input); # Get rid of trailing CR/LF # Check for unencoded equal signs. If there are none, the input # didn't come from a FORM. if ( $input !~ /=/ ) { die "Query String not from FORM\n"; } # Query string okay. Split data into name=value fields, at the ampersand @fields = split ("&", $input); # Process each field and put it into an associative array foreach $one (@fields) { ($name, $value) = split("=",$one); # split at the equal sign &convert($name); # decode the name and value strings &convert($value); $array{"$name"} = $value; # put data into associative array } if (!defined($array{"order"})) { die "Query String not from pizza order form\n"; } # Put data into a file: output/orders.txt; directory must exist unless(open (OUTFILE, ">> output/orders.txt")) # open for append { &error("Unable to open output file: orders.txt"); } print OUTFILE "Name: ", $array{"name"}, "\n"; print OUTFILE "Address: ", $array{"address"}, "\n"; print OUTFILE "Size: ", $array{"size"}, "\n"; print OUTFILE "Toppings: ", $array{"toppings"}, "\n"; print OUTFILE "------------------------------------------\n"; # Send the response page # Fixed data is sent using HERE documents # HTTP header must end with a single blank line print < Your Order

Purple Pizza Order Confirmation

Thank you for ordering from Dr. Hwang\'s Purple Pizza Parlor.

EndOfHTMLHeader # Send the variable data print "

You have ordered a ", $array{"size"}, " pizza with "; if (scalar(@toppings) == 0) { print "no toppings.

\n"; } else { print join(", ", @toppings), " as toppings.

\n"; } print "

Your pizza will be delivered in about a half hour to:
\n"; print $array{"name"}, "
\n"; # Split address into lines and print each one @lines = split ("\n", $array{"address"}); foreach $line (@lines) { print $line, "
\n"; } print "

\n"; # Send end of document print < EndOfHTMLFooter # Get around security issues sub untaint { $_[0]=~/\A(.*)\Z/m; $_[0]=$1; return $1; } sub convert { $_[0] =~ s/\+/ /g; # Convert + to space $_[0] =~ s/%(..)/pack("c",hex($1))/ge; # Convert URL hex to Latin-1 } sub error { # Send error page and exit print < Error In Form Submission

Error in Form Submission

The following error was detected:

EndOfHTMLHeader # Send the variable data print "

", $_[0], "

\n\n"; # Send end of document print <Please use the Back button to correct your form and resubmit

EndOfHTMLFooter exit 0; }