A second look shows me that, the way you use Validate.pm, you are getting untainted data by immediately using the global $Validate::var. That is an awkward design which demands you call the validation/untaint function each time you need the variable (since $var may have changed in the interim). The solution is to write your functions to validate and untaint the variable you hand them. Here is how to write your val_alpha() function that way (untested),

# val_alpha validates as [:alpha:], spaces, and hyphens.
# Usage: val_alpha \$foo [, \$bar]
sub val_alpha {
    for (@_) {
        if ($$_ =~ /^([A-Za-z -]*)$/) {
            $$_ = $1;
        }
        else {
            error_page()
        }
    }
    1;
}
[download]

That should validate and untaint for all time the variables you hand it.