luna the doggie :neofox_snug: :therian: on Nostr: my point is largely that using a framework/language where you're not at risk of ...

my point is largely that using a framework/language where you're not at risk of accidentally eval'ing or running something unintended unless you deliberately run eval or idk don't use your SQL libraries' substitution feature, makes it much harder to fuck up in critical ways

With CGI as I understand it you have to think about:
- what exactly are your web server settings, what will be allowed to be executed
- path traversal issues
- advanced sysadmin knowledge to mitigate the above (chroots, restricting permissions, namespacing, etc)
- ensuring you don't accidentally put some file that shouldn't be there in the web server root directory
- parsing/escaping whatever inputs you get correctly

With more abstracted systems you will not have to worry about a lot of those things, just handling things correctly in your code, which can be reasonably simple when you use things like say Pydantic to validate the structure and contents of the received data