Form handling in Perl can be a very involved process. Below is a step-by-step for creating a simple feedback form. A visitor to your website fills this out and the information is emailed to you.<\/p>\n
First we need to create a simple HTML form, to start with we’ll keep the form simple by just asking for the users email address and comments. Here is our HTML form:<\/p>\n
<html>\n<head>\n<title>Simple Feedback Form<\/title>\n<style>label{display:block;}<\/style>\n<\/head>\n<body>\n\n<form action=\"\/cgi-bin\/feedback_form.cgi\" method=\"post\">\n\n<label>Email Address<\/label>\n<input type=\"text\" name=\"email_address\" size=\"40\">\n\n<label>Your Feedback<\/label>\n<textarea name=\"feedback\" cols=\"50\" rows=\"10\"><\/textarea>\n\n<input type=\"submit\" name=\"send\" value=\"Submit\">\n\n<\/form>\n\n<\/body>\n<\/html><\/pre>\n<\/br>This form will send two parameters to our cgi script, email_address<\/i> and feedback<\/i>. Save this file as feedback_form.html<\/i> and upload it to the web<\/strong> folder on your hosting.<\/p>\nCreate the form script<\/h3>\n
We’re going to use the CGI.pm Perl module<\/strong> to help make writing our cgi script easier. At the top of the script we start with the location of the perl interpretor, then we tell Perl we want to use the CGI.pm module and create a new cgi object:<\/p>\n#!\/usr\/bin\/perl\n\nuse CGI;\n\nmy $cgi = new CGI;<\/pre>\n<\/br>The CGI.pm module is object-orientated, this means all of the CGI.pm functions and data are accessed through an instance of CGI.pm, in our script this instance is called $cgi<\/i>.<\/p>\n
Lets use our CGI object to retrieve the information from the form the user filled in. To access the form parameters we can use the CGI objects param<\/i> function:<\/p>\nmy $email_address = $cgi->param('email_address');\nmy $feedback = $cgi->param('feedback');<\/pre>\n<\/br>We store the form data in two local Perl variables, $email_address<\/i> and $feedback<\/i>.<\/p>\nFiltering user submitted data<\/h3>\n
Whenever you write a cgi script that receives data from an unknown source you should always filter the data to make sure it doesn’t contain anything harmful. For example, if we don’t filter the data in our form it would be quite easy for a Hacker to use our cgi script to send out spam to thousands of people. The golden rule is never trust any data you haven’t created or don’t control.<\/p>\n
To filter our user data we’re going to create two filter functions:<\/p>\n
sub filter_email_header\n{\nmy $form_field = shift;\n$form_field = filter_form_data($form_field);\n$form_field =~ s\/[nr|!\/<>^$%*&]+\/ \/g;\n\nreturn $form_field;\n}\n\nsub filter_form_data\n{\nmy $form_field = shift;\n$form_field =~ s\/From:\/\/gi; \n$form_field =~ s\/To:\/\/gi; \n$form_field =~ s\/BCC:\/\/gi; \n$form_field =~ s\/CC:\/\/gi; \n$form_field =~ s\/Subject:\/\/gi; \n$form_field =~ s\/Content-Type:\/\/gi; \n\nreturn $form_field;\n}<\/pre>\n<\/br>The first filter function removes special characters which could be used to trick our script into sending spam and is applied to the $email_address<\/i> data.The second filter function removes common email headers from the data the user submitted and can be applied to both $email_address<\/i> and $feedback<\/i>. We’ll place the two functions at the bottom of our script.<\/p>\n
Now we’ll call the two filter functions to clean up our user submitted data:<\/p>\n
$email_address = filter_email_header($email_address);\n$feedback = filter_form_data($feedback);<\/pre>\nEmailing the feedback<\/h3>\n
Once we have the filtered data we need to email it back to you. Our web hosting servers run a local mail server (sendmail) that your cgi script can use to send email. To send the email our cgi script opens a communication channel to the sendmail program using the pipe (|) symbol. It then prints all the information necessary to send an email across that channel:<\/p>\n
open ( MAIL, \"| \/usr\/lib\/sendmail -t\" );\nprint MAIL \"From: $email_addressn\";\nprint MAIL \"To: you@domain.comn\";\nprint MAIL \"Subject: Feedback Form Submissionnn\";\nprint MAIL \"$feedbackn\";\nprint MAIL \"n.n\";close ( MAIL );<\/pre>\n<\/br>Make sure you set your email address on line 3, you’ll need to escape the @ symbol by putting a backslash () before it because Perl uses the @ symbol to denote a special type of variable. The two newline characters (nn) at the end of line 4 are used to mark the end of the email headers ready for the content. The n.n on line 6 prints a dot (.) on its own line to tell sendmail that we’ve finished printing the message.<\/p>\n
Thank the user for their feedback<\/h3>\n
Finally, when a user submits your form, let’s show a page thanking them for their feedback:<\/p>\n
print $cgi->header(-type => 'text\/html');\n\nprint <<HTML_PAGE;\n<html>\n<head>\n<title>Thank You<\/title>\n<\/head>\n<body>\n<h1>Thank You<\/h1>\n<p>Thank you for your feedback.<\/p>\n<\/body>\n<\/html>\nHTML_PAGE<\/pre>\n<\/br>The first thing we do is print back the HTTP header, using the CGI header function, to let the web browser know what type of content to expect. Then we print out the HTML page.<\/p>\n
The final script<\/h3>\n
This example script shows a very basic way to get form contents emailed to you, it doesn’t however have the refinements of a professional script, e.g. input validation. Below is the finished script. We’ve added some comments (lines beginning with #) to help make it clearer.<\/p>\n
#!\/usr\/bin\/perl\n\nuse CGI;\n\n# Create a CGI.pm object\nmy $cgi = new CGI;\n\n# Get the form data\nmy $email_address = $cgi->param('email_address');\nmy $feedback = $cgi->param('feedback');\n\n# Filter the form data\n$email_address = filter_email_header($email_address);\n$feedback = filter_form_data($feedback);\n\n# Email the form data\nopen ( MAIL, \"| \/usr\/lib\/sendmail -t\" );\nprint MAIL \"From: $email_addressn\";\nprint MAIL \"To: you@domain.comn\";\nprint MAIL \"Subject: Feedback Form Submissionnn\";\nprint MAIL \"$feedbackn\";\nprint MAIL \"n.n\";\nclose ( MAIL );\n\n# Print the HTTP header\nprint $cgi->header(-type => 'text\/html');\n\n# Print the HTML thank you page\nprint <<HTML_PAGE;\n<html>\n<head>\n<title>Thank You<\/title>\n<\/head>\n<body>\n<h1>Thank You<\/h1>\n<p>Thank you for your feedback.<\/p>\n<\/body>\n<\/html>\nHTML_PAGE\n\n# Functions to filter the form data\n\nsub filter_email_header\n{\nmy $form_field = shift; \n$form_field = filter_form_data($form_field); \n$form_field =~ s\/[nr|!\/<>^$%*&]+\/ \/g; \n\nreturn $form_field ;\n}\n\nsub filter_form_data\n{ my $form_field = shift;\n$form_field =~ s\/From:\/\/gi; \n$form_field =~ s\/To:\/\/gi; \n$form_field =~ s\/BCC:\/\/gi; \n$form_field =~ s\/CC:\/\/gi; \n$form_field =~ s\/Subject:\/\/gi; \n$form_field =~ s\/Content-Type:\/\/gi;\n\nreturn $form_field ;\n}<\/pre>\n