Web Servers A Web page may seem harmless, but it's what's in the Web page that counts. The jeopardy in a Web server comes from the way the Web pages are created and the content they hold. CGI lets programs output information to a Web server. CGI scripts run on your Web server when a Web page that has one is requested by a client. They can contain code designed to loosen security in any number of ways.
Scripts can copy files, delete files, or even add or modify user accounts.
Anything a programmer can think of is possible as long as the operating system allows it. Protecting yourself against malicious CGI scripts under Windows NT relies on your Web server's ability to limit program execution to certain directories and your ability to correctly configure your NTFS file security permissions. A good Web server always lets you limit the directories from which a CGI script can run. You should consider letting your scripts reside in and execute from only one directory. Configure that directory's permissions for access only by the Web server and the administrator.