Question

for a perl cgi script, what is the difference (technically) between these two?

#!/usr/bin/perl 
use CGI; 
$cgi = new CGI; 
print $cgi->header(),
$cgi->start_html(),
$cgi->pre($cgi->param()), 
$cgi->end_html();

and

#!/usr/bin/perl 
use CGI; 
$cgi = new CGI; 
print $cgi->header(),
$cgi->start_html(), 
$cgi->pre($ENV{'QUERY_STRING'}), 
$cgi->end_html();

Answer 1

Assume an HTTP request like this:

GET my.cgi?foo=bar&baz=buz

When run under a webserver with a conventional CGI interface, the environment variable QUERY_STRING will be foo=bar&baz=buz. The environment variable will not be URL-unescaped. Printing it with $cgi->pre(...) will simply enclose the env var with <pre></pre> tags (or a single <pre /> tag if the value is or is coerced to an empty string.

$cgi->param(), on the other hand, and assuming a list context with no arguments, will return a list of URL-unescaped CGI parameter names, in this case foo and bar.

(Note that $cgi->pre(...) does not HTML-escape its argument, so $ENV{QUERY_STRING} might just jeopardize your cgi with a little cross-site scripting injection.)