Rob said:
>I don't agree. I think that with dummy inputs available in forms, we can
>finally move away from using PATH_INFO to convey state information to
>scripts and go back to using them for their intended purpose: To allow
>scripts to access the server's virtual->physical translation and access
>authorization for auxillary files. If you're using filenames in PATH_INFO
>then you don't have to escape the information, and if you have it as dummy
>inputs in a form then your data is already escaped anyway.
I agree that PATH_INFO is not the right place for user input, but
PATH_INFO is something generated by the script for use by the script.
The server shouldn't be touching it. It shouldn't even have any
idea if % or some other escaping is done on the information there.
As long as there are no bad characters in it, it just doesn't matter.
I certainly don't agree with your idea of the intended purpose of
CGI scripts. I use them all the time for dynamically translating
data into browser-understandable formats (like HTML). Input
forms and searches are just one possible use.