for my final project last year i had to code my own server in c and have it interface with a previous project that we had worked on to act as an http/ftp server. while coding it up, i quickly discovered several security holes that i thought i should pass along to anyone dealing with cgi.