my $username;
If ($form{username} =~ /^([\w.-]+)$/) {
  $username = $1;
}
else {
 die("invalid username");
}