my ($untained_file) = $name =~ /^(\w+)$/ or die "bad filename: $name"; open (FILE,">c:/apache/htdocs/directory/tmpl/$untained_file.tmpl"); print FILE $content; close(FILE);