Question: Do you really really want to trust the file name submitted by the user/browser? Or would you prefer to use the temp file name provided by CGI.pm or one generated yourself which you'll know doesn't contain any dodgy characters (top-bit set, spaces, 'rm -rf' type things). If you are just displaying the filename, I see no problem (but then why not display the path as well?), but the thought of actually using it as a filename on your server brings me out in a shiver!