#!/usr/bin/perl -T
#
# unsafe-form.pl
#
# CGI.pm Perl script demonstrating how easy it is to
# tamper with "hidden" form field values.
#
# Written by Advosys Consulting Inc., Ottawa
#
# Requires: Perl 5 with CGI.pm
#

# Include perl modules:
use CGI qw/:standard/;

# Print the MIME header before doing anything else:
print "Content-type: text/html\n\n";
print '&lt;html&gt;&lt;body&gt;';
print '&lt;h1&gt;Unsafe input form demo&lt;/h1&gt;';

# Assign some example values we don't want changed:
$userid = 'ktrout';
$credit_ok = 1;
$form_expires = '20001001:12:45:20';

# Display blank HTML form or check submission:
if ( ! param('chaddr') ) {
	print_form();
}
else {
	print "Thank you ", param('userid'), "&lt;br&gt;";
	print "Your address information has been updated.";
}

print "&lt;/body&gt;&lt;/html&gt;";


### SUBROUTINES:
#

sub print_form {
# Prints example HTML form with signature in a hidden field:
print&lt;&lt;END_TEXT;
&lt;p&gt;&lt;form action="http://advosys.ca/cgi/unsafe-form.pl" method="post"&gt;
&lt;table&gt;
&lt;tr&gt;
&lt;td&gt;&lt;b&gt;Address line 1:&lt;/b&gt;&lt;/td&gt;&lt;td&gt;&lt;input type="text" name="address1"&gt;&lt;/td&gt;
&lt;tr&gt;
&lt;td&gt;&lt;b&gt;Address line 2:&lt;/b&gt;&lt;/td&gt;&lt;td&gt;&lt;input type="text" name="address2"&gt;&lt;/td&gt;
&lt;tr&gt;
&lt;td&gt;&lt;b&gt;City:&lt;/b&gt;&lt;/td&gt;&lt;td&gt;&lt;input type="text" name="city"&gt;&lt;/td&gt;
&lt;tr&gt;
&lt;td&gt;&lt;b&gt;Prov:&lt;/b&gt;&lt;/td&gt;&lt;td&gt;&lt;input type="text" name="prov"&gt;&lt;/td&gt;
&lt;tr&gt;
&lt;td&gt;&lt;b&gt;Postal:&lt;/b&gt;&lt;/td&gt;&lt;td&gt;&lt;input type="text" name="postal"&gt;&lt;/td&gt;
&lt;tr&gt;&lt;td colspan="2" align="center"&gt;
&lt;input type="hidden" name="userid" value="$userid"&gt;
&lt;input type="hidden" name="credit_ok" value="$credit_ok"&gt;
&lt;input type="hidden" name="form_expires" value="$form_expires"&gt;
&lt;input type="submit" name="chaddr" value="Change address"&gt;
&lt;/td&gt;&lt;/tr&gt;
&lt;/table&gt;
&lt;/form&gt;
END_TEXT
}