# (must precede untaint) # Set query param to site home if url is: # / /index.pl /index.pl? /index.pl?page param('page','home') if ! defined param('page'); # Untaint query param if ($query = param('page') =~ /^(\w+)$/) { $urlist = $1; } else { $urlist = 'error'; } # Build array of urlist files opendir DIR, "$confdir/"; my @files = grep { $_ ne '.' && $_ ne '..' && } readdir DIR; closedir DIR; unless (grep{$_ eq $urlist} @files) { $urlist = 'error'; }