Also of relevance besides Zaxo's comments is Ovid's
Web programming with Perl Course, which covers the subject of calling the shell from CGI scripts and threats in detail.
-- I'm Not Just Another Perl Hacker
Comment on Re: Remove or Identify Shell Commands In A Form