Talking about safe-guards: you might want to check the -t and -T switches.

To the regexp:

• The check-logic is wrong, you want to bail out safely if either of the values is undefined, not both
• One \w character in the input is enough ATM to match, so but you want to check that the whole value matches only \w-characters
• that leads to something like

  ($box !~ /^[my allowed characters in a handy class]+$/ ||
  $value !~ /^[my allowed characters in a handy class]+$/
  [download]

hth,
regards,
tomte