You not only have to check if your data is OK (which you do in your regex) but you actually have to launder tainted data by extracting the good bits with a regex and put them into another variable through the use of sub-patterns.

From the docs (perlsec)

the (...) way to bypass the tainting mechanism is by referencing subpatterns from a regular expression match.

(...)

Here's a test to make sure that the data contains nothing but "word" characters (alphabetics, numerics, and underscores), a hyphen, an at sign, or a dot.

    if ($data =~ /^([-\@\w.]+)$/) {
        $data = $1;                     # $data now untainted
    } else {
        die "Bad data in '$data'";      # log this somewhere
    }
[download]