Hi lfindle, just a quick note in addition to all the useful advice above.

One alternative (to constructing the pathname by untainting user-supplied parameters) would be to match the incoming parameters against a hash of allowable values. Obviously this only works if there are a fixed set of allowable values.

So, say that the incoming param is called 'dir', and you don't want to allow anything except 'a','b' or 'c', you could do:

my %allowed_dirs = (a => 'a', b => 'b', c => 'c');
my $dir = $allowed_dirs{$q->param('dir')};
die "go away, you nasty horrid hacker" unless defined $dir;
[download]

Then you can interpolate $dir into your path in the certain knowledge that Everything Is All Right.

hth,
andy.