On a more general level, all user input should of course be considered 'suspect' until proven innocent. Judicious use of the 'taint'-facilities of Perl and untainting user input through regexes is the way to go.

CountZero

"If you have four groups working on a compiler, you'll get a 4-pass compiler." - Conway's Law