How dangerous is it to have a user's password in plaintext in a cgi script?
You should always put application passwords in O/S Environment Variables (envvars).


Can only be read by the assigned O/S user (or root)
You won't accidentally screw up file permissions (if putting passwords in files)
You won't accidentally check passwords in to source control (this is particularly important in open source)
Survives reboots
envvars are easy to read with most languages
You should follow the principle of least privilege and run say your web server as its own user.


http://perldoc.perl.org/Env.html