Probably getting it from an ENV variable, (QUERY_STRING or HTTP_REFERER). And they may be using some Php to parse the URL and pass it in.

I set up a dummy shtml page and substituted printenv for the SSI cgi script. Both env listings show the extra parameters in QUERY_STRING_UNESCAPED and REQUEST_URI. Both servers are getting the data set in the environment but only one script is working. Same script on both servers. I'll keep digging. The only difference between the two printenv pages is that one server has more environment variables than the other some are different but they are not vars that would seem to be relavent to this problem.

you don't need anything to pass data in the URI string. It does not matter if it's a .shtml page or some other page. You don't even need a page at all. Just type anything you want into the URI string and it will get passed to the server.

The problem is the cgi script on one server wasn't "finding" the extra parameters that were entered on the URI line.

Looking at the script, the lines that went out and got the extra parameters were:

my $cgi = new CGI;
our %in = map { $_, $cgi->param($_) } $cgi->param;

Where %in contains the key/value pairs... we looked at these values on the server that workes and the one that doesn't work. On the "broken" server, %in did not contain anything. The working server contained the valid data.

We were able to fix the problem on the "broken" server by adding this one line before the "my $cgi = new CGI;"

$ENV{QUERY_STRING} = $ENV{QUERY_STRING} ¦¦ $ENV{QUERY_STRING_UNESCAPED};

This just dumps the data in QUERY_STRING_UNESCAPED into QUERY_STRING if QUERY_STRING is null.

I don't know if this poses a security problem but it seems to work. I still don't understand why this same cgi script works on one server and not the other. The only thing I can think of is there must be a difference in the cgi modules on the two servers.

try this, instead of:

my $cgi = new CGI;
our %in = map { $_, $cgi->param($_) } $cgi->param;

try:

my $cgi = new CGI;
my %in = $cgi->Vars;

whoever wrote this line:

our %in = map { $_, $cgi->param($_) } $cgi->param;

does not have a good working knowledge of the CGI module. It will work but the Vars function is used for that exact purpose. I also see no need to declase the hash with 'our', but if you have problems you can switch back to 'our'.

my $cgi = new CGI;
our %in;
%in = $cgi->Vars;