...
param('user') =~ /^(\w+)$/
  or die "Bad parameter " . param('user');

my $theFile = "$1.txt";

...