At The Sphere CGI programs provide a powerful mechanism for enhancing the quality and usefulness of your Web page. They also open the door for hackers to exploit your script to do their dirty work. The biggest danger with CGI programs, is letting a string sent from the browser be interpreted by a Unix shell on the server. This can happen quite innocently.
Most people code CGI mail programs that put the delivery address on the form as an argument.
Your program has just sent a normal message to frank, AND sent our password file to the hacker. This can be avoided by scrubbing all strings that are going to be sent through the Unix shell. For C programs scrubString can be used to clean up strings for safe use with the shell. For Perl programmers there is a Perl version of scrubString . If you are using other languages, please review the algorithms here and incorporate them into your programs.