If the user enters text with some characters that aren't allowed, I would like to strip out the invalid characters and keep the rest.

I can do that like so. (This is a much-simplified pattern.)

$input =~ s/[^a-zA-Z]//g;

However, it appears that doing the above will not officially untaint $input. Passing it to a DBI operation causes the program to bail out with a "tainted data" error. In order to officially untaint it, I have to capture a match, like so:

$input =~ /([a-zA-Z]+)/;
$input = $1;
[download]

Unfortunately, that will capture only the text up to the first invalid character, discarding everything after that.

How can I capture all of the valid text?

I could do this:

$input =~ s/[^a-zA-Z]//g; # keep valid stuff
($input) = $input =~ /(.*)/; # now officially untaint it
[download]

But obviously that doesn't feel exactly kosher.

Thanks in advance!