Generating $cmd inside the CGI is good, and your code may indeed be safe (hard to judge without seeing the actual code), but using dropdown lists does not help. Users can make their web clients submit anything they want, really.