Form the tiny snippet you put i can oly guess that the value for $username comes from outside the script and you are not untainting it before passing it to the shell. As for the error showing up without the -T, IIRC perl automaticlly turns on taint mode when the script is suid. DO a search on perlsec for more info