As for the entire pick-a-file thing ... there should still be a list of permissible files being presented within the PHP. At that point, both the Perl and the PHP need to agree on what this list of files is so that the PHP can present the list and the Perl can validate against it. Just because you have more than one code file doesn't mean the solution is wrong.

Sorry, I was unclear. It certainly doesn't make it wrong, but I don't have control over the PHP files, so it isn't a solution I can implement. For someone else, who is taking this discussion as advice on how to write a green-field project, it would certainly be a good way to go.