If you insist on piping to sendmail

I don't!

As I said in the original post, this was soe very, very old code that I looked at. It is so old that I had forgotten I had piped to sendmail. My mail module of choice is MIME::Lite for most things.

Thank you for all the useful information.
As the code is still working in a production environment, sendmail must still be up there doing its things - and you have reminded me that I need to look into taint mode. Something I know very little about and the bit I do is a result for recent mentions in the Monastery.