From the perlsec manpage (read it!):

Laundering data using regular expression [sic] is the only 
mechanism for untainting dirty data

[download]

(it goes on to qualify this statement, but the mechanism that provides the exception to this rule goes deeper than we need to)

And tr/// doesn't really fall under 'regular expressions'. You have to use Perl's facility for capturing parts of pattern matches, i.e. you need to capture only those bits of data that you want using parentheses within regular expressions.

PERL DOES NOT KNOW WHICH DATA IS SAFE, it only knows when to no longer mark the data as tainted. So the programmer has to know what sort of input is safe, and what sort of input is not. What is 'dangerous' ? Well, shell metacharacters, usually. So this might be a start (adapted from Programming Perl, 2nd ed. p. 358): 

sub untaint {
    my $data = shift;
    if ($data =~ /^([-\@\w.]+)$/) {
        $data = $1;
        return $data;
    } else {
        die "somebody tried something nasty, I think: '$data' contains
+ questionable characters.\n";
    }
}

[download]

The regex tests the string to see whether it contains anything other than @, -, a dot, or a word character. If it doesn't, it untaints it (by setting the data to the text captured within the parens in the regular expression), and will die with a warning if there's something not good with it. Depending on your needs, you could do various things, of course; you'll need to be handy with regular expressions, though!

HTH

Philosophy can be made out of anything. Or less -- Jerry A. Fodor

In reply to Re: Untainted done right! by arturo
in thread Untainted done right! by SilverB1rd

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.