I've taken over supporting a time- and expense-entry system. Apache's CGI. CGI programs are written in bash :) I'm going to add some features into it and exposing it out to many more users, but prior to that wanted to get some thoughts on what else needs to be looked-at *first* in terms of security, holes, CGI gotchas, &c.

Not a lot of users, but the application performs really well and is written consistently and very heavily in bash. Pages look like ASP/JSP/PHP format with heavy use of here docs. Parameters are inferred from a separate C program and session info is stored at the DB (MySQL) and SQL parameter/injections are escaped properly.

I'm torn as if this stack really needs to be stripped out or not? **What would one need to look out for in a whole application written for the most part directly in bash?**