@@ -112,7 +112,7 @@ \subsection{Using the cgi module}
112112instance but a list of such instances. Similarly, in this situation,
113113\samp {form.getvalue(\var {key})} would return a list of strings.
114114If you expect this possibility
115- (i.e., when your HTML form contains multiple fields with the same
115+ (when your HTML form contains multiple fields with the same
116116name), use the \function {type()} function to determine whether you
117117have a single instance or a list of instances. For example, here's
118118code that concatenates any number of username fields, separated by
@@ -283,21 +283,21 @@ \subsection{Functions}
283283HTML-safe sequences. Use this if you need to display text that might
284284contain such characters in HTML. If the optional flag \var {quote} is
285285true, the double quote character (\character {"}) is also translated;
286- this helps for inclusion in an HTML attribute value, e.g. in \code {<A
286+ this helps for inclusion in an HTML attribute value, as in \code {<A
287287HREF="..."> }.
288288\end {funcdesc}
289289
290290
291291\subsection {Caring about security }
292292
293- There's one important rule: if you invoke an external program (e.g.
294- via the \function {os.system()} or \function {os.popen()} functions),
295- make very sure you don't pass arbitrary strings received from the
296- client to the shell. This is a well-known security hole whereby
297- clever hackers anywhere on the web can exploit a gullible CGI script
298- to invoke arbitrary shell commands. Even parts of the URL or field
299- names cannot be trusted, since the request doesn't have to come from
300- your form!
293+ There's one important rule: if you invoke an external program (via the
294+ \function {os.system()} or \function {os.popen()} functions. or others
295+ with similar functionality), make very sure you don't pass arbitrary
296+ strings received from the client to the shell. This is a well-known
297+ security hole whereby clever hackers anywhere on the web can exploit a
298+ gullible CGI script to invoke arbitrary shell commands. Even parts of
299+ the URL or field names cannot be trusted, since the request doesn't
300+ have to come from your form!
301301
302302To be on the safe side, if you must pass a string gotten from a form
303303to a shell command, you should make sure the string contains only
@@ -337,7 +337,7 @@ \subsection{Installing your CGI script on a Unix system}
337337
338338If you need to load modules from a directory which is not on Python's
339339default module search path, you can change the path in your script,
340- before importing other modules, e.g. :
340+ before importing other modules. For example :
341341
342342\begin {verbatim }
343343import sys
@@ -383,7 +383,7 @@ \subsection{Debugging CGI scripts}
383383
384384If this gives an error of type 404, the server cannot find the script
385385-- perhaps you need to install it in a different directory. If it
386- gives another error (e.g. 500) , there's an installation problem that
386+ gives another error, there's an installation problem that
387387you should fix before trying to go any further. If you get a nicely
388388formatted listing of the environment and form content (in this
389389example, the fields should be listed as `` addr'' with value `` At Home''
@@ -402,12 +402,12 @@ \subsection{Debugging CGI scripts}
402402This should produce the same results as those gotten from installing
403403the \file {cgi.py} file itself.
404404
405- When an ordinary Python script raises an unhandled exception
406- (e.g. because of a typo in a module name, a file that can't be opened,
407- etc.), the Python interpreter prints a nice traceback and exits.
408- While the Python interpreter will still do this when your CGI script
409- raises an exception, most likely the traceback will end up in one of
410- the HTTP server's log file, or be discarded altogether.
405+ When an ordinary Python script raises an unhandled exception (for
406+ whatever reason: of a typo in a module name, a file that can't be
407+ opened, etc.), the Python interpreter prints a nice traceback and
408+ exits. While the Python interpreter will still do this when your CGI
409+ script raises an exception, most likely the traceback will end up in
410+ one of the HTTP server's log file, or be discarded altogether.
411411
412412Fortunately, once you have managed to get your script to execute
413413\emph {some } code, it is easy to catch exceptions and cause a traceback
0 commit comments