4.3. CGI

CGI variables are the raw data which comes from the user.

You can use them for testing without worry, though you should never set their value into a database or display on the page unless you have processed them first, as they can have arbitrary values. The most common security risk is displaying HTML code, which allows remote scripting exploits like cookie-stealing.

    [calc]
        ####  DO NOT DO THIS!!!!
        my $out = $CGI->{varname};
        return $out;
    [/calc]

That will transform the value. If you wish to output a safe value but keep the actual value intact, do:

    [calc]
        ####  This is safe, makes value safe for rest of page
        my $out = $Tag->cgi( { name => 'varname', filter => 'entities' } );
        ####  This is safe too, doesn't transform value
        my $other = $Tag->filter($CGI->{varname}, 'entities');

        ### Now you can return stuff to the page
        return $out . $other;
    [/calc]

The access methods are:

  Access in ITL with                 Attributes
  -----------------------            -------------------
  [cgi varname]                      Doesn't stop ITL code, don't use!
  [cgi name=varname filter=entities] Use this for safety

  Embedded Perl                From
  -----------------------      -------------------
  $CGI->{varname}              Don't use for output values!

They can be set as well.

  Set in ITL with                       Attributes
  -----------------------               -------------------
  [cgi name=varname set="VAL"]          Sets to VAL, VAL can be ITL, shows VAL
  [cgi name=varname set="VAL" hide=1]   Sets to VAL, VAL can be ITL, no output

  Embedded Perl                From
  -----------------------      -------------------
  $CGI->{varname} = 'VAL';     Sets to VAL, next access to [cgi varname]
                               shows new value