What exactly is the bit you are referring to? Is it WashName()? Because this also relies on my $filename = $cgi->param( $field ); to get the original albeit possibly dangerous/with-strange-chars filename. So when I would enforce a [A-Z0-9] file-naming convention, it would also fail on getting the original non-canonical name, no?