The important part of my earlier reply was the bit about Scalar::Util::tainted (which I would just repeat now); the stuff about the regexps was just BTW.