Please re-read the documentation. You initialize $file_name from $cgi->param('doc');. The documentation of CGI initializes it from $cgi->upload(...). Maybe if you try that the name won't be empty.

Later in your code, you are trusting that the user did not set the filename to something like ../remote-shell.php or even ./remote-shell.php. Giving users the ability to specify the content and the name of a file on your system is a really bad idea.