Ahh...

Do they all have the same pathname and extension? If so, then just write "../data/texts/$file.txt". However, I think I might have a better structure for the popup menu.

$i = 0;
foreach (@files) {
  %label_hash{$_} = $display_names[$i++];
}
#Have to have a hash in a -labels field,

print popup_menu(-name => 'choice", -values => \@files, -labels => %la
+bel_hash)
[download]

Peace,
LassiLantar

Now your user sees pretty labels, while your param("choice") will still return full pathnames.

Yes, that makes it easier to go to things like "http://server/script.cgi?choice=%2Fetc%2Fpasswd" too ;)

--
b10m

All code is usually tested, but rarely trusted.

Hehe, good point b10m. So is the only way to pass things like this securely by storing them in local files inaccessible to the user since you can't pass anything between instances of the script (non-persistant environment) and you shouldn't pass anything as a value (not secure)?

Peace,
LassiLantar