<G> Actually I realized that all that passing in was unnecessary -- redundant here, but I was commenting on the point about $select and $IN->_whatever_ being equally insecure. $select is "better" for the reasons above.

$IN should only be used in the original .cgi, or when you think the original .cgi didn't pass it in, or you are desperately trying to find a value, any value, and not bomb. But it's a risk. Are you grabbing the $IN that was, or the $IN that is now?

Once you call other modules (the jump.cgi / Jump.pm type construct, excluded) you should use explicitly passed values. Especially in things like the globals, or called functions from the templates. $IN will be unreliable. Even in the Jump.pm type construct, $IN should be called as soon as possible, then assigned to $in if needed more than initially. You at least know you have a uniform snapshot of what was in $IN when you started to work with it.

$IN is out of the modules control, but $in is encapsulated as best as perl can do it.

We've differed on this for quite a while now <G> But I'm old-school, and like to play it safe.


PUGDOG� Enterprises, Inc.

The best way to contact me is to NOT use Email.
Please leave a PM here.