General-purpose data processor?

[Tirmie]

Hi,

I'm making an online quiz; I need to write the results of the quiz to a file, called quizresults.txt. Does anybody have a general-purpose script that can accept data from a loadVariable() action, write it to quizresults.txt, and sends back a "status" variable? (The "status" variable would just be "error" or "successful".) Preferably, the script should accept any data, not just predefined variables.

Note: Flash won't ever need to view the info in the .txt file, just write to it.

If not, could you refer me to any online information explaining how to accomplish this?


[Edited by Tirmie on 04-09-2002 at 03:54 PM]

[Musicman]

Hi,

what about this one

#!/usr/bin/perl

if($ENV{REQUEST_METHOD} eq 'POST')
{ read STDIN, $buffer, $ENV{CONTENT_LENGTH};
}
else
{ $buffer = $ENV{QUERY_STRING};
}
print "Content-type: text/plain\n\n";

if(open(OUT, ">save.txt"))
{ print OUT $buffer;
close OUT;
print "status=success";
}
else
{ print "status=fail";
}

Musicman

[Tirmie]

That looks like it would do this trick. I have no experience with Perl, so I have three questions:

1.) Does this script place any limitations on the data being written? i.e., do the variable names need to be in a certain format, or anything like that?

2.) Is this the proper form of the loadVariables() command to use?

loadVariables ("http://www.myserver.com/cgi-bin/myscript.pl", "_root.MCContainingData", "POST");

3.) The 'print "status ="' lines create variables on the same timeline that called the loadVariables action, right? If so, are they strings?

[Edited by Tirmie on 04-10-2002 at 03:36 PM]

[Tirmie]

Actually, one more quick question. Could the script be modified to accept the name of the .txt file as a variable? I realize that the .txt files would have to have the proper permissions set, but this would make the script fantastically general-purpose.

If not, no problem. Thanks a lot for your help!
[Edited by Tirmie on 04-10-2002 at 03:35 PM]

[Tirmie]

Booting to top.

[Musicman]

Hi Tirmie,

it could... but it would not remain so simple then. You need to actually extract the variables and also add some code to ensure that nobody could send you filenames you do not want.

Variable names: they should qualify for actionscripting: letters, digits, underscore, no initial digit.

The print "status=" sends just one variable back, trying to report the common error when a file cannot be written.

Musicman

[Tirmie]

All right. Thanks again for your help!

[Tirmie]

Why do I need to worry that someone might send me a filename I don't want? I thought the script couldn't write to a file unless its permissions were set just right.

[Musicman]

Hi,

consider this scenario: you have the script in your cgi-bin, and you put a directory results in that.
Now, if someone sends a filename like ../myscript.pl, this would try to overwrite the script. Providers that do not even run scripts set to 777 permissions rather to 755 are just trying to help you avoid problems.
You definitely should not allow ../ in file names
If you create files quiz1.txt, quiz2.txt etc. in advance and make them writable, the system would be safe. If you allow the script to create files in that directory, you had better be careful.
BTW: would one file quizresults indicate that only best results are saved, or do you consider one file for everyone who completes it, named after the user?

Musicman

[Tirmie]

All the results for a particular quiz will be written to a single file. Then, I'll import this file into Excel.