Your recent column on FormMail left me scratching my head. Why would anyone continue to recommend this buggy, insecure and poorly written script? Even the author, Matt Wright, recommends not using his older scripts, but to use upgraded versions available
Your column on FormMail left me scratching my head. Why would anyone recommend this buggy, insecure and poorly written script? Even the author of FormMail, Matt Wright, recommends not using his older scripts, but to use upgraded versions provided by the London Perl Mongers group.
Given the ability to replace the older FormMail script with the newer, more secure TFMail version, I also would recommend the upgrade.
Common Gateway Interface (CGI) programming standards have evolved, and so have the support tools available for handling Web forms with Perl CGI scripts.
The nms versions from SourceForge are more secure drop-in replacements for the original scripts found at Wright’s script archive and can help reduce the risk of having your site used as an open mail relay or worse.
Some of the most important security enhancements are the replacement of the parameter parsing methods used in the older versions with more robust error checking and character handling that greatly reduce the possibilities of successful code injection attacks and server compromise through malicious Web form input.
