my $filename = $query->param('filename');
my $fh = $query->param('file');

# clean $filename, especially in Taint mode

open(OUTPUT, '>' . $path . $filename) or carp "Can't open $filename: $!";
select(OUTPUT);
print while (<$fh>);