form validation with perl - Shell Programming and Scripting

LNC · #1 12-20-2007

Hey guys, I'm just messing around with a perl webpage. The idea is to make a simple validation form that will later insert a record into my DVD database. it's all very basic at the moment, and I worked up my script from the form validation example I found on this website: http://www.elated.com/articles/form-validation-wi
th-perl-and-cgi/ . When I put this script on my webserver, it works fine.

My form just has 3 text fields and a button. The problem is, when I enter text and try to submit, the text I entered dissapears and I get the error messages, stating that the boxes are empty. For the life of me, I can't figure out what is wrong with it. Mind you, I've just started learning PERL in bits and pieces, from examples I find on the web, so if I'm missing the obvious here, please don't shoot me .

Any help or pointers is more than welcome

Anyway, here's the script:

Code:

#!/usr/bin/perl
use CGI;

# Create the CGI object
my $query = new CGI;

# Output the HTTP header
print $query->header();

# Process form if submitted; otherwise display it
if ( $query->param("submit") )
{
process_form();
}
else
{
display_form();
}

sub process_form
{
if ( validate_form() )
{
print <<END_HTML;
<html><head><title>Thank You</title></head>
<body>
Thank you - your form was submitted correctly!
</body></html>
END_HTML
}
}

sub validate_form
{
my $dvd_title = $query->param("dvd_title");
my $number_of_discs= $query->param("number_of_discs");
my $year = $query->param("year");
my $error_message = "";

$error_message .= "Please enter the DVD title<br>" if ( !$dvd_title );
$error_message .= "Please enter the number of discs<br>" if ( !$number_of_discs );
$error_message .= "Please enter the year<br>" if ( !$year );

if ( $error_message )
{
# Errors with the form - redisplay it and return failure
display_form ( $error_message, $dvd_title, $number_of_discs, $year );
return 0;
}
else
{
# Form OK - return success
return 1;
}
}

sub display_form
{
my $error_message = shift;
my $dvd_title = shift;
my $number_of_discs = shift;
my $year = shift;

# Remove any potentially malicious HTML tags
$dvd_title =~ s/<([^>]|\n)*>//g;
$number_of_discs =~ s/<([^>]|\n)*>//g;
$year =~ s/<([^>]|\n)*>//g;

print <<END_HTML;
<html>
<head><title>Add a DVD</title></head>
<body>

<form action="adddvd3.pl" method="post">
<input type="hidden" name="submit" value="submit">

<table>
<tr><td colspan="2" style="text-align:center">$error_message</t
d></tr>
<tr><td>DVD Title:</td><td><input type="text" name="dvd_title" value="$dvd_title"></td></tr>
<tr><td>Number of Discs:</td><td><input type="text" name="number_of_discs" value="$number_of_discs"></td></tr>
; <tr><td>Year:</td><td><
;input type="text" name="year" value="$year"></td></tr>
<tr><td colspan="2" style="text-align:center"><input type="submit" name="submit" value="submit"></td></tr>
</table>
</form>

</body></html>
END_HTML
}

Smiling Dragon · #2 12-20-2007

Quote:

Originally Posted by LNC

Code:

#!/usr/bin/perl
use CGI;

# Create the CGI object
my $query = new CGI;
...
sub validate_form
{
my $dvd_title = $query->param("dvd_title");
my $number_of_discs= $query->param("number_of_discs");
my $year = $query->param("year");
my $error_message = "";
...

Take with a grain of salt, I don't nomrally use perl in an OO fasion like you are here.
I think you might be getting caught up by the scoping of your CGI object.
I would suggest either passing it to the validate_form function or dropping the 'my' keyword when you create it.

cbkihong · #3 12-20-2007

I put this in my Web server, entered something and submit, and got

"Thank you - your form was submitted correctly!"

Is this your expected result? The posted script seems to look fine to me.

The debate between the procedural and the OO camp has always been there.

Personally I see nothing wrong with using OO-style in Perl. One major Perl-based discussion forum (I don't give the name here as it is semi-commercial) is fully OO, and IMO OO in Perl is nothing more than subroutines that happen to contain "instance" data with "packages" offering namespace separation. Neither of them I would agree being cited as hindrance rather than help. In fact, in recent years PHP is starting to aware they need this kind of things now when they attract more sophisticated developers who have experiences with other language environments.

Scoping in Perl can be complex, but once you understand it, it is a useful device to prevent variable collision and inadvertently stomping on global variables you don't intend to access. If you have happened to write any Perl thing that spans more than 50 script files or so, you will know this is far easier to happen than you would imagine.

By the way, it is a consensus in the Perl community that new code should be runnable with "use strict", and variables without explicitly marked 'my', 'our', or 'local' (with package qualification), will not pass the strict test.

Surely one is free to select his/her approach. My opinion is we should be open about others' choices even if we have a different stance personally.

Smiling Dragon · #4 12-20-2007

Quote:

Originally Posted by cbkihong

The debate between the procedural and the OO camp has always been there.

Surely one is free to select his/her approach. My opinion is we should be open about others' choices even if we have a different stance personally.

Definately no issue with OO, I'm just pointing out that my advise might be flawed as I'm not very familiar with OO

LNC · #5 12-21-2007

That was indeed what I was aiming for, however, on my webserver it doesn't seem to work, whereas the example script in the link I posted does. If needed, I could pm a link to the script on my server. I don't really want to post it here, as it is just a private server in my house.
I can't figure out why one script would work fine, and the other wouldn't.

cbkihong · #6 12-21-2007

It is difficult to provide concrete help:

1) You previously mentioned the posted script didn't work, but my test of the script verbatim you said was what you intended to get;

2) You did not tell what are the differences between the script you deployed and the one you posted. Of course, you should post the simplest variation of your script, in full, that is sufficient to demonstrate and have others reproduce the problem.

I have not visited the link you provided, so I do not quite understand how I can help you with this. If you have further details to share, please feel free to post again.

More UNIX and Linux Forum Topics You Might Find Helpful
Thread	Thread Starter	Forum	Replies	Last Post
validation on a parameter	Henley55	UNIX for Dummies Questions & Answers	1	04-20-2008 01:33 PM
S-231: Adobe Form Designer and Form Client Vulnerabilities	iBot	Security Advisories (RSS)	0	03-27-2008 07:10 AM
perl cgi form action target	garric	Shell Programming and Scripting	4	12-08-2007 10:07 PM
URL form ip	wojtyla	Linux	1	04-09-2005 05:39 AM
Changing Unix form to Microsoft Word form to be able to email it to someone.	Cheraunm	UNIX for Advanced & Expert Users	8	05-24-2002 12:58 AM

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode