I'm curious. First, you identify that the single argument form of
system() is a potential problem, but then you proceed on to use it. If you're going to use
system("/usr/sbin/useradd $cli");
then you need to prevent
$cli from having as it's trailing substring something day-ruining like
"... ; /bin/rm -rf *"
You don't have this problem with the multiple argument form, since you're bypassing the shell entirely. Here's a simple reworking:
my $username = ... untaint $formdata{'username'};
... etc. for other form variables
my @cli = ("-s", $shell,
"-d", $home,
"-G", $group
$usrname);
...
system("/usr/sbin/useradd", @cli);
Edit: s/training/trailing/