- CGI.pm is shit
- CGI is shit
<"ARGV">shouldn't work underuse strictbecause thats a string dereferencing a symbolic ref.- Hash Keys can't retain tainting and so can be used to propagate un-vetted data into safe spaces:
my $hash = unsafe_thing_that_returns_a_hash();
$dbh->query(join keys %{$hash}); # data will be untained regardless of what it is.- CGI.pm should probably do something smarter than simply returning the first
paramwhen >1 params