I'm curious. First, you identify that the single argument form of system() is a potential problem, but then you proceed on to use it. If you're going to use   system("/usr/sbin/useradd $cli"); then you need to prevent $cli from having as it's trailing substring something day-ruining like   "... ; /bin/rm -rf *" You don't have this problem with the multiple argument form, since you're bypassing the shell entirely. Here's a simple reworking:

  my $username = ... untaint $formdata{'username'};
  ... etc. for other form variables

  my @cli = ("-s", $shell,
             "-d", $home,
             "-G", $group
             $usrname);
  ...
  system("/usr/sbin/useradd", @cli);
[download]

Edit: s/training/trailing/