Option 2

At first, I went to visit the http://www.w3.org/CGI/. In this website, they have a intro in CGI scripts. I went in further and went to one of the links which says Intro to The Common Gateway Interface. In there, I learned that the Common Gateway Interface (CGI) is a standard for interfacing external applications with information servers, such as HTTP or Web servers. A plain HTML document that the Web daemon retrieves is static, which means it exists in a constant state: a text file that doesn't change. A CGI program, on the other hand, is executed in real-time, so that it can output dynamic information.CGI program can be written in any language that allows it to be executed on the system, such as C/C++, Fortran, PERL, TCL, Any Unix shell, Visual Basic or AppleScript.

After that, I went around surfing the website about CGI scripts. I was then interested with the security issue with CGI Scripts. I went to http://jmarshall.com/easy/cgi/cgi_footnotes.html#security. This one of the links in www.jmarshall.com/easy/cgi.In that web page, It reminder me that a CGI script is a program that anyone in the world can run on your machine. Accordingly, look out for security holes as you write your script. It mention that we should not trust the user input. In particular, don't put user data in a shell command without verifying the data carefully, lest a hacker drive a virtual truck through this security hole. The example they gave was :

Let's say you have a CGI program that lets users run "finger" on your host. Such a Perl script might have a line like

system "finger $username" ;

But if a malicious user enters "james; rm -rf /" as the username, your program runs

system "finger james; rm -rf /" ;

which erases as many of your files as possible, probably not what you intended. So verify that the username is valid, with something like

$username!~ /[^\w.-]/   || die "Whoa!  Nice try, buddy." ;

or use a different form of the system command:

system("finger", $username) ;

or come up with another way to solve the problem.

They have reminder us that it is easy for a hacker to send any form variables to your script, with any values. Our security shouldn't rely on fields having certain values, or even existing or not existing.