Here's the REx Fastolfe posted:

($secure) = ($tainted =~ /(\w+)/);

I certainly agree that the success needs to be checked, as there's an open being called with $secure on the next line, but $secure will not be ending up with a previous value of $1; if the REx fails, it will simply be undefined.

-dlc