# Bad
@output = `ls -l $user_input`;

# Good
if ($kidpid = open(PIPE, "-|"))
{
        # Parent process.  Read data from the child.
        @output = <PIPE>;
} else {
        # Child process.  Execute the command.
        die "could not fork" if !defined($kidpid);
        exec ("ls", "-l", $user_input) or die "exec failed: $!";
}