how to store untainted string in perl

[kokul]

Hi friends,

I want to take a description (atleast 50 characters) from the html page using cgi->param and store it into a string variable in perl and pass this string variable to a query. for this i wrote the following code

my $desc = $cgi->param('comment ')

then the error occured

Software error:
Insecure dependency in exec while running with -T switch at /var/www/html

So i changed the above line to

my $desc = $cgi->param('comment ') =~ m/(.+)/ ? $1 :'';

is it correct???

Now error is not comming but the query insert function is not working..

But when i'm assigning the $desc with some string directly..then the query insert function is working properly..

Can anyone plz help me to solve this problem..

Thanks in advance
Kokul

[KevinADC]

it looks like it should work, but try like this and see if it helps:

my $desc = '';
if ($cgi->param('comment') =~ m/(.+)/) {
   $desc = $1;
}

but really the regexp is not making $desc secure in any meaningful way because you are just accepting whatever value it has. But maybe you're just trying to get the syntax correct for right now.

[kokul]

it looks like it should work, but try like this and see if it helps:

my $desc = '';
if ($cgi->param('comment') =~ m/(.+)/) {
   $desc = $1;
}

but really the regexp is not making $desc secure in any meaningful way because you are just accepting whatever value it has. But maybe you're just trying to get the syntax correct for right now.

Dear Kevin,

The above code is working... But it takes only the first line from the text box. I want to take all the lines. How can i do it??

[KevinADC]

add the "s" modifier to the end of the regexp:

if ($cgi->param('comment') =~ m/(.+)/s) {