my %allowed_files = (
    file1  => '/path/to/file1', 
    file2  => '/path/to/file2', 
    file3  => '/path/to/file3', 
);

# $file already processed from CGI params
my $file_name = defined($allowed_files{$file}) ? 
    $allowed_files{$file} : die "Bad file name\n";