I see where that would be possible. But would a user not need
to know the name of a subroutine in my script?
Yes he would. But how difficult is that? How difficult is it to just
*guess* for starters, but more specifically, your form's parameter
list is giving him at least a subset of all options.
My goal is to try and combine as many functions as possible into
one script, rather than have 5 or 6 separate scripts to maintain.
I have no idea what this issue has to do with the issue being
discussed.
Which brings up a question: if a user
can call any subroutine in my script, what's to stop them from
running a separate script as well?
.... absolutely nothing. You should write ALL scripts residing on a
publically accessable webserver to be secure, and to check that only
those who are running the script "correctly" can do anything. If I
randomly type the address to one of your CGI scripts into my browser's
address bar, passing it data of my own creation, your script should be
able to handle that gracefully and not do anything it shouldn't do.
If there is no secure way to do this with this particular method I
would like to know so as to fix it.
You've already been given (or considered yourself) a few ways to do
this correctly. Either create a dispatch table as Anno demonstrated,
or check the value of each parameter to make sure it matches an
acceptable value.
Paul Lalli