Website hosting service by

 Back to Index

11.2.6 Caring about security

There's one important rule: if you invoke an external program (via the os.system() or os.popen() functions. or others with similar functionality), make very sure you don't pass arbitrary strings received from the client to the shell. This is a well-known security hole whereby clever hackers anywhere on the Web can exploit a gullible CGI script to invoke arbitrary shell commands. Even parts of the URL or field names cannot be trusted, since the request doesn't have to come from your form!

To be on the safe side, if you must pass a string gotten from a form to a shell command, you should make sure the string contains only alphanumeric characters, dashes, underscores, and periods.



2002-2004 Webhosting Service


Disclaimer: This documentation is provided only for the benefits of our hosting customers.
For authoritative source of the documentation, please refer to


Cheap domain name registration - Register domain name and domain transfer from $5.95/year only

Domain registration - Domain registration, domain name transfer and domain search services