I'm not sure I understand the problem.
What does your variable really contain? What is the length of c:\dir? 5 or 6? Can you post a snippet?

If you need a way to escape special characters you can use the quotemeta built-in.

I don't use CGI so I'm afraid that I can't help you there.