sub untaint {
    my $var = $_[0];
    my ($untained_file) = $var =~ /^([\w-]+)$/ or die "bad filename: $var";
    return $untained_file;
}