Too bad you can't use DBI and I don't know what the heck DataObject is, but I hope it uses DBI underneath. Using -T switch could help in conjunction with Taint option of DBI (if, again, you use DBI). Use regex to validate user inputs, but you need to define what constitutes bad or good input. For example, to allow only alphanumeric character,

my $user = get_username();
if ($user =~ /^(\w+)$/) {
  $user = $1;
} else {
  die "Hey, you gave me bad input: $user\n";
}
# proceed with untainted $user
[download]