As CountZero says above, white listing is a much better idea in general for this type of issue since you don't have to worry so much about what you missed; it's a literal fail safe. I'd probably do something like: 
sub filter {
    my $file = shift;
    if (defined $file) {
        return $file if $file =~ /[\w.]/;
    }
    return;
}

[download]

The biggest question in all this is what are you going to do with the string when you are done? For example, if you are feeding this to client display, most templates (HTML::Template) can handle the escaping for display literals without much difficulty. If you are passing it to an open, you can use the 3 argument form to avoid a lot of vulnerability. If you are passing it to system, multiple argument forms also handle escaping for you.

#11929 First ask yourself `How would I do this without a computer?' Then have the computer do it the same way.

In reply to Re: Filtering unwanted chars from input field by kennethk
in thread Filtering unwanted chars from input field by Anonymous Monk

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.