The really sad part is is this not some new thing. I mean this exact trick is on pg 201 of O'reilly's 'Cgi Programming with Perl'. At very least the security chapter of that book should be required reading before people even look at cgi-code.