I'd like to add to what ww was saying. The security implications of a cgi that handles uploads are many. You might want to consider hard coding the path to the upload directory. If, not, be very very very strict when you check the results from whatever mechanism you do use. Be sure to turn on taint checking.