# untaint!
$cgi->param('field') ~= m/(.*)/;
$cgi->param('field', $1);