I have some (vague) misgivings about combining untainting and validation as CGI::Untaint and others do. In some cases you would want input to remain tainted, even after it's validated.

That said, I don't use taint mode very often so I'm not is a good position to judge the risk-convenience balance.