title: Do Perl CGI programs have a buffer overflow or script vulnerability for HTML contact forms?
body: <p>My hosting company says it is possible to fill an HTML form text input field with just the right amount of garbage bytes to cause a buffer overflow/resource problem when used with Apache/HTTP POST to a CGI-Bin Perl script (such as <a href="http://nms-cgi.sourceforge.net/scripts.shtml" rel="nofollow noreferrer">NMS FormMail</a>). </p>
  
  <p>They say a core dump occurs at which point an arbitrary script (stored as part of the input field text) can be run on the server which can compromise the site. They say this isn't something they can protect against in their Apache/Perl configuration&mdash;that it's up to the Perl script to prevent this by limiting number of characters in the posted fields.  But it seems like the core dump could occur before the script can limit field sizes.</p>
  
  <p>This type of contact form and method is in wide use by thousands of sites, so I'm wondering if what they say is true. Can you security experts out there enlighten me&mdash;is this true? I'm also wondering if the same thing can happen with a PHP script.  What do you recommend for a safe site contact script/method?</p>