merlyn: very good point. but, can't you get round this by enclosing the variables in quotes? e.g.

>perl -e '
    sub string_to_struct {
 my $string = shift;
 
 my @refs = split /__/, $string;
 $string = "\$$refs[0]";
 for (1 .. $#refs) { $string .= "-> {q/$refs[$_]/}" };
 
 return eval "\\$string";  
}
print string_to_struct "foo__`rm xxx`"; 
'
SCALAR(0x8056ba4)

>ls
...
xxx
... 
>perl -e '
    sub string_to_struct {
 my $string = shift;
 
 my @refs = split /__/, $string;
 $string = "\$$refs[0]";
 for (1 .. $#refs) { $string .= "-> {$refs[$_]}" };
 
 return eval "\\$string";  
}
print string_to_struct "foo__`rm xxx`"; 
'

SCALAR(0x8056bb0)
> ls
[argh! xxx has been removed]
[download]

Anyway, I'll check the refs and consider making sure all my configs get written in a safe way. It still wouldn't be nice to let them set any variable, I guess....

update:
Great reference. That solves it. Once again, chromatic sorts me out.

update 2:
Well, not completely. Chromatics solution in the thread referred to above will traverse a hash and show all the keys (and values). I'll have a think how to hack it to go just to the key and value you want.

update 3:
And by the way, my claim that the code above would be safe is not true - see replies to this post for why.

David