Replace this:

  $username =~ $1;
[download]

with this:

  $username = $1;
[download]

It'll both untaint the string, and do what is wanted.

There's still lots of superfluous/horrible stuff in there, but at least, it should work now.