I've decided to bite the bullet and just taint-check the whole thing. Once the CGI params have been detainted properly, then I can add a manual taint to the X-Forwarded-For value and see what tainted() will show, closer to the DBI calls.

Does DBI do taint checking on its own?

Thanks!