diff --git a/cgi/koth.lua b/cgi/koth.lua
new file mode 100644
index 0000000..ac6aa39
--- /dev/null
+++ b/cgi/koth.lua
@@ -0,0 +1,45 @@
+#! /usr/bin/lua
+
+local koth = {}
+
+-- cut -d$ANCHOR -f2- | grep -Fx "$NEEDLE"
+function anchored_search(haystack, needle, anchor)
+ for line in io.lines(haystack) do
+ if (anchor) then
+ pos = line:find(anchor)
+ if (pos) then
+ line = line:sub(pos+1)
+ end
+ end
+
+ if (line == needle) then
+ return true
+ end
+ end
+
+ return false
+end
+
+function koth.anchored_search(haystack, needle, anchor)
+ local ok, ret = pcall(anchored_search, haystack, needle, anchor)
+
+ return ok and ret
+end
+
+function koth.page(title, body)
+ print("Content-type: text/html")
+ print()
+ print("")
+ print("" .. title .. "")
+ print("
" .. title .. "
")
+ if (body) then
+ print("")
+ print(body)
+ print("")
+ end
+ print("")
+ os.exit(0)
+end
+
+
+return koth
diff --git a/cgi/puzzler.cgi b/cgi/puzzler.cgi
index 56ea236..04206d9 100755
--- a/cgi/puzzler.cgi
+++ b/cgi/puzzler.cgi
@@ -1,14 +1,30 @@
#! /usr/bin/lua
local cgi = require "cgi"
+local koth = require "koth"
+local team = cgi.fields['t'] or ""
+local category = cgi.fields['c'] or ""
+local points = cgi.fields['p'] or ""
+local answer = cgi.fields['a'] or ""
--- Read in team and answer
+-- Defang category name; prevent directory traversal
+category = category:gsub("[^A-Za-z0-9]", "-")
+-- Check answer
+local needle = points .. " " .. answer
+local haystack = "../puzzles/" .. category .. "/answers.txt"
+local found = koth.anchored_search(haystack, needle)
+if (not found) then
+ koth.page("Wrong answer")
+end
-print("Content-type: text/html")
-print()
-print("
")
-print(cgi.fields["t"])
-print("
")
+local ok = koth.award_points(team, category, points, "P");
+if (not ok) then
+ koth.page("Error awarding points", "You got the right answer, but something blew up trying to give you points. Try again in a few seconds.")
+end
+
+koth.page("Points awarded",
+ "