asked on

Perl Script not handling File uploads in form...

I am currently using the following perl script (http://nms-cgi.sourceforge.net/) to handle a form that I have on my website. The form has one section where a file (a picture) is uploaded, and I have been told the perl script I am using does not support this. Here is the form:

<FORM METHOD=POST

ACTION="http://www.thephotofix.completelyfreehosting.com/scgi-bin/FormMail.pl"

ENCTYPE="multipart/form-data">

<input type="hidden" name="subject" value="The Photofix">

<LABEL for="realname">Your name [optional]:</LABEL> <br>
<INPUT TYPE="text" NAME="realname">
<p>

<LABEL for="email">Email address:</LABEL><br>
<INPUT TYPE="text" NAME="email">
<p>

<LABEL for="file">Upload picture:</LABEL><br>
<input type="file" name="file" size="40">
<p>

<LABEL for="services">Services requested on this photo:</LABEL><br>
<textarea rows="10" cols="30" name="services">
Type what you would like to have done to your photo.
</textarea>
<p>

<LABEL for="prints">How are you reaching this page?</LABEL><br>
<SELECT name="prints" id="prints">
<OPTION value="other">No response (Answer later via e-mail)</option>
<OPTION value="4x6">Yes, 1(one) 4X6 photo. [+4 dollars]</option>
<OPTION value="5x7">Yes, 1(one) 5X7 photo. [+4 dollars]</option>
<OPTION value="8x6">Yes, 1(one) 8X6. [+4 dollars]</option>
<OPTION value="yes">Yes, other amount or size, specified in list of

services.</option>
<OPTION value="no">No, email me the finished product.</option>
</SELECT>
<p>

<input type="hidden" name="recipient" value="grimtooth@fuse.net">
<input type="submit" value="Submit">

</FORM>

I need to be directed to a new perl script that is secure and will handle all the parts of my form, or shown what to add to my perl script for it to allow file uploads to be sent to me via e-mail. Thanks

SOLUTION

ahoffmann

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

grimtooth

ASKER

I had no idea where to put that in the script, but I looked through it and found a section that looked appropriate. Here is what that part looks like:

# USER CUSTOMISATION SECTION
# --------------------------
# Place any custom code here

use CGI;
my $q=new CGI;
my $f=$q->param('file');
my $file=$f;
$file=~s/[^a-zA-Z0-9\.\-]//g;
# your code here to sanatize the passed filename
open(F,">$file") && while (my $bytesread=read( $f,$buffer, 8192 )) {print F $buffer;}

&& close F;

# USER CUSTOMISATION << END >>
# ----------------------------
# (no user serviceable parts beyond here)
}

When I attempt to run the form, I get this error: "500 Error referred from http://www.thephotofix.completelyfreehosting.com/test2.html" Definitely from the addition of this code, because I recieved no error messages before.

ASKER CERTIFIED SOLUTION