Three problems with the code you showed: 1. It doesn't compile. 2. /^[^0-9]$/ only tests whether the string consists of a single character that is not a digit. I assume you meant /[^0-9]/. 3. When an input contains an invalid value, all you do is print an additional line of output, you probably meant die instead of print.

In addition, to prevent XSS attacks, you should use a module to escape any strings you're inserting into the output.