Big ups to ajt. Solid explanation. My only addition- when you saw this method in two other books, I bet they didn't have taint checking on. It would be wrong to accept file uploads without taint checking.

You're going the right route, your next task is to figure out how to de-taint data, and the links ajt provided will help you get there, especially perlsec

Good start! You're almost there.