A few minor points on file uploads.

First of all the CGI.pm docs are particularly bad on this point. They do not even die on failed opens. In addition when done right you should be sure to address issues such as race conditions and not trusting user input for filenames.

And speaking of not trusting user input, the following Phrack article should give some food for thought on how easy it is to go very, very wrong. And note that simple taint checking may or may not help, often people just pass virtually anything through rather than thinking about why the check is there and what can happen.

Among other things it will show you why security concious programmers are likely to explicitly:

open (FOO, "<$foo") or die "Cannot read $foo: $!";
[download]

rather than just trusting the filename...