Why do this at all, even if it isn't a security issue? FWIW, some of these will simply crash the program, others will depend on whether you directly use the special variables (like $_ for implied $_ as in print if /match/;) or indirectly (like $/ for file reading).

If the forged form contains a name that you have not pre-declared this will simply crash the script, but for these built-in vars you do have an issue. But why even write your CGI so that it can crash so easily? Since you have to predeclare all your valid param names for $$param to even work, why not simply use my $this = param( 'this' ); in the first place? That way you can introduce default values or error detection and detainting all at the same time.

my $this = text_detaint( param('this') ) || 'default text';

or 

my $this = num_detaint( param('this') ) or
    output_error( "this", "must be a number" );
[download]