Thus, it is essential that you protect all files against writing unless you are currently working on them. In other words, if you are not editing an HTML file, it should be set to read-only access. In short, never grant write permission to any file on your web server unless you are specifically editing that file. Finally, backup your files regularly. Expect and prepare for the worst.
All input is an attempted hack.
All input is an attempted hack. All input is an attempted hack. Learn those words and repeat them to yourself every day. It is essential for you to consider all information that comes into your CGI script as tainted. The example provided by Lincoln Stein above is a good example of the kinds of havoc a cracker can create with tainted data.