my @files = glob "$ENV{'DOCUMENT_ROOT'}/data/text/*.txt";
my @display_files = map m{([^/]+)\.txt}, @files;
Encode::from_to($_, 'ISO-8859-7', 'utf8') for @display_files;

# SO FAR, SO GOOD.  The same @display_files array is used later to create
# the popup menu, which shows up correctly/as intended in the browser,
# so this use of Encode::from_to() is correct and necessary.

if ( param('select') )  {   #If User selected an item from the drop down menu

    my $selected_file = decode('utf8', param('select'));  ## ADD THIS LINE
                         ### UPDATED  3 days after initial post: it was originally
                         ###  "encode" which, as Nik points out below, was wrong

   unless ( grep  /^\Q$selected_file\E$/, @display_files ) 
      #If User Selection doesn't match one of the passages then its a Fraud!
   {
         ## REPORT AN INVALID SUBMISSION (you don't need to worry about saying
         ## what properties it has that make it invalid -- it doesn't match any
         ## known file name, and that is all that matters.
         ##  ... but before exiting, send some kind of error page back to the browser

         exit;
    }

    ## IF YOU GET HERE, YOU HAVE A VALID MATCH
    ## so you can see where your next coding mistake is...