CGI::NoPoison 3.11

CGI::NoPoison is No Poison Null Byte in CGI->Vars.

SYNOPSIS

use CGI;
use CGI::NoPoison

my $m = CGI->new();
$m->param(
-name=>amplifier,
-value=>[nine, ten, up to eleven],
);
my %h = $m->Vars();
# look ma, no splitting on poison null-bytes ( )!
print "$_ => ", join ", ", @{$h{$_}} for keys %h;

print "This one goes ", ($m->param(amplifier))[2];

Simplicity itself. Instead of using a null-byte to separate multi-valued fields why not just use what CGI.pm already uses to store the values internally?

"Whats that?", you ask? Why, its an anonymous array, of course, like anyone sensible would use. cgi-lib.pl may have been fine years and years ago, but this now-archaic throwback no longer needs us to bow to its demands. (is anyone still actually using it? yikes.)

This does, however change how you parse CGI->Vars() (as an anon-array, not a -packed string) and also how you set params.

NOW you can properly test for inserted null-bytes in a secure environment WHILE taking advantage of the convenience of the Vars() function.