The example code in the article is a bit weird. Why are the query parameters handled on a case-by-case basis in the cgiHandler function (in the web server)? CGI normally passes parameters to the script in the QUERY_STRING variable or on standard input for POST requests. See the spec[0] for details.

An older version of the article[1] also handled the headers in the web server instead of leaving it up to the script as you normally would with CGI scripts. It's really more of an example of executing a subprocess than implementing CGI.

Also, the "significant vulnerability to injection attacks" has nothing to do with CGI. It comes from taking plain text as input and then treating it as HTML without actually converting it to HTML. The solution is not to "sanitize" it but to encode it into the format you want to output.

[0] https://datatracker.ietf.org/doc/html/rfc3875.html

[1] https://web.archive.org/web/20231226033541/https://rednafi.c...