Linux Server Security, Second Edition

This is the Title of the Book, eMatter Edition

Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.

Web Applications

|

347

script, such as a database query, command execution, or file I/O. It also does not

give you more time than Apache’s

Timeout variable.

Perl

Perl has the trusty database-independent module DBI and its faithful sidekicks, the

database-dependent (DBD) family. There are DBD modules for many popular data-

bases, both open source (MySQL, PostgreSQL) and commercial (Oracle, Informix,

Sybase, and others).

A MySQL connection function might resemble this:

# my_connect.pl

sub my_connect

{

my $server = "db.test.com";

my $db = "db_name";

my $user = "db_user";

my $password = "db_password";

my $dbh = DBI->connect(

"DBI:mysql:$db:$server",

$user

$password,

{ PrintError => 1, RaiseError => 1 })

or die "Could not connect to database $db.\n";

return $dbh;

}

1;

As in the PHP examples, you’d rather not have this function everywhere. Perl has,

characteristically, more than one way to do it. Here is a simple way:

require "/usr/local/myperllib/my_connect.pl";

Keep the my_connect.pl script outside Apache’s DocumentRoot directory to prevent

its contents from being viewed. If your connection logic is more complex, it could be

written as a Perl package or a module.

Taint mode won’t protect you from entering tainted data into database queries. You’ll

need to check the data yourself. Perl’s outstanding