I'd think that a surname could contain an apostrophe (') too.

Thus, you might want something like

param("surname")=~/^[\pL\- '.]+$/ and $surname = $1;
[download]

Update there are surnames with dots too, so I've added it too.