My original post may not have been clear.   Logic I'm shooting for goes something like this:

1. untaint via word-characters only
2. if /index.pl?page=illegal_character *or* if /index.pl?page=nonexistant_urlist
   • send to page=error
3. if /index.pl?page=valid_urlist
   • send to page=requested
4. if URL does *not* include /index.pl?page=something
   • send to page=home

With answers from yourself, Ovid, davorg, and a, I expect I can come up with code that will work.   Thanks and ++ to all 8^)

Update: Hours past my bedtime and I've got what appears to work.   Round o' ++, my treat!   8^D

# (must precede untaint)
# Set query param to site home if url is:
#    /    /index.pl    /index.pl?   /index.pl?page
param('page','home') if ! defined param('page');


# Untaint query param
if ($query = param('page') =~ /^(\w+)$/) {
    $urlist = $1;
    }
else {
    $urlist = 'error';
    }


# Build array of urlist files
opendir DIR, "$confdir/";
my @files = grep {
    $_ ne '.' &&
    $_ ne '..' &&
    }
readdir DIR;
closedir DIR;
unless (grep{$_ eq $urlist} @files) {
    $urlist = 'error';
    }
[download]

    cheers,
    Don
    striving for Perl Adept
    (it's pronounced "why-bick")