I cannot agree more strongly with this approach involving File::Basename suggested by jarich, it being the same which I employed, with HTTP::BrowserDetect for portability, for the file name determination in the CGI::Upload module.

From the CGI::Upload module ...

#   Determine and set the file system parsing routines 
#   based upon HTTP client header information.
#
fileparse_set_fstype(
    sub {
        my $browser = HTTP::BrowserDetect->new;
        return 'MSWin32' if $browser->windows;
        return 'MacOS' if $browser->mac;
        $^O;
    }
);
my @file = fileparse($cgi->param($param), '\.[^\.]*');

#   Return undef if file name cannot be parsed from file 
#   field parameter
#
return undef unless $file[0];
[download]