I'd suggest that you verify that it only contains valid characters. So if your usernames can contain alpha and '.' only, you could use something like (untested):

if($display =~ /[^a-b\.]/i){
    # error condition here
}
[download]

Modify the regex to add additional conditions to suit your exact needs.