in reply to RE: Possible Security Hole
in thread CGI and Traceroute

qw( $param_cmd )
is simply the string $param_cmd, not the contents of the variable.

-- Randal L. Schwartz, Perl hacker