$tainted =~ s/\W//g;  # remove all non word characters
if ($tainted =~ /\A([a-zA-Z0-9]{1,16})\z/i)