No, that's backwards. If you're building CGI, you do not want to use re eval. The default is the safety that I insisted they add.

Just use this:

my $regex = param('foo');
$regex = eval { qr/$regex/ };
if ($@) { "it was bad... handle it" }
[download]

Then use $regex later, safely, as a compiled regex. In fact, wait, it's simpler than that:

my $regex = param('foo');
$regex = eval { qr/$regex/ } or do {
  # handle failure
};
[download]

since eval will return undef on a failed block, or the compiled Regex object (always true) if it's a valid regex.

-- Randal L. Schwartz, Perl hacker