Specifically, when you use backticks or call system() with a scalar argument, the argument is passed to the system shell (typically /bin/sh). If you call system() with an array argument, the args are executed directly.

This has important security implications because the system shell will interpolate metacharacters. See 37385 for a more detailed explaination.

Try this and see if it works:

        if (open(PROGRAM, "-|"))
        {
                # Parent process.  Read output from child.
                my @output = <PROGRAM>;
        }
        else
        {
                # Child process.  exec() program
                exec("/path/to/program", $arg1, $arg2, $etc);
        }
[download]

-Matt