#!/usr/bin/perl use CGI; $query = new CGI; $act = $query->param('act'); $name = $query->param('name'); if ( ( $act eq "Execute with SQL" ) or ( $act eq "Execute without SQL" ) ) { # Print HTML. print( "Content-type: text/html\n\n" ); # Use "here-doc" syntax. print <

EndofHTML # Remove leading and trailing spacing. $name =~ s/^\s*(\S*)\s*$/$1/; # For security, remove some Unix metacharacters. $name =~ s/;|>|>>|<|\*|\?|\&|\|//g; # Compose a Java command. $cmd = "/usr/bin/java -Djava.security.egd=file:/dev/./urandom test '$act' '$name' "; print( $cmd . "

" ); system( $cmd ); print <

EndofHTML } elsif ( $act eq "HTML source" ) { print ( "Content-type: text/plain\n\n" ); $cmd = "/usr/bin/lynx -dump -source " . $ENV{HTTP_REFERER}; $cmd .= "; echo \n\n\n\n"; system( $cmd ); } elsif ( $act eq "CGI source" ) { # Print plain text. print ( "Content-type: text/plain\n\n" ); system( "/bin/cat test.cgi; echo \n\n\n\n" ); } elsif ( $act eq "Perl source" ) { print ( "Content-type: text/plain\n\n" ); system( "/bin/cat test.pl; echo \n\n\n\n" ); } elsif ( $act eq "Java source" ) { print ( "Content-type: text/plain\n\n" ); system( "/bin/cat test.java; echo \n\n\n\n" ); } elsif ( $act eq "SQL source" ) { print ( "Content-type: text/plain\n\n\n" ); system( "/bin/cat sql.txt; echo \n\n\n\n" ); } elsif ( $act eq "Help" ) { print ( "Content-type: text/html\n\n" ); system( "/bin/cat Help.html" ); } else { print( "Content-type: text/html\n\n" ); print( "No such option: $act" ); }