From the perlsec manpage (read it!):

Laundering data using regular expression [sic] is the only 
mechanism for untainting dirty data
[download]

(it goes on to qualify this statement, but the mechanism that provides the exception to this rule goes deeper than we need to)

And tr/// doesn't really fall under 'regular expressions'. You have to use Perl's facility for capturing parts of pattern matches, i.e. you need to capture only those bits of data that you want using parentheses within regular expressions.

PERL DOES NOT KNOW WHICH DATA IS SAFE, it only knows when to no longer mark the data as tainted. So the programmer has to know what sort of input is safe, and what sort of input is not. What is 'dangerous' ? Well, shell metacharacters, usually. So this might be a start (adapted from Programming Perl, 2nd ed. p. 358):

sub untaint {
    my $data = shift;
    if ($data =~ /^([-\@\w.]+)$/) {
        $data = $1;
        return $data;
    } else {
        die "somebody tried something nasty, I think: '$data' contains
+ questionable characters.\n";
    }
}
[download]

The regex tests the string to see whether it contains anything other than @, -, a dot, or a word character. If it doesn't, it untaints it (by setting the data to the text captured within the parens in the regular expression), and will die with a warning if there's something not good with it. Depending on your needs, you could do various things, of course; you'll need to be handy with regular expressions, though!

HTH

Philosophy can be made out of anything. Or less -- Jerry A. Fodor