Or, instead of just trying to verify the shell paramaters, you can properly escape them. Like:

for ($message,$user,tty) { s/'/'\\''/g; }
system("echo '$message' |/usr/bin/write '$user' '$tty'");
[download]

That way if someone tries to pass in a $message of '; rm -rf /; echo ' then, it's cool, you just write that out, not execute it.