if($file_name=~/^(\w+)$/) {
    $file_name=$1;  #no longer tainted
}

open(FH, "> users/grades/$file_name") or die "Can't open grades for $file_name: $!";