First, check that the regex match actually succeeded, don't just assume and go on to use $1 and $2. Second, pass "$1", not $1. See Re: Tainting problem on Strawberry perl and its parent.