my %allowed_dirs = (a => 'a', b => 'b', c => 'c');
my $dir = $allowed_dirs{$q->param('dir')};
die "go away, you nasty horrid hacker" unless defined $dir;