I'm trying to make a function called param which is a wrapper for CGI::param. Its only purpose is to go through what is returned from param($string) and untaint it.

Here is the code I've got:

package GWP::Safe;
$VERSION='1.0';
require 5.000;
require Exporter;

use lib "modules";
use GWP::Prefs;
use CGI ();

@ISA = qw(Exporter);
@EXPORT = (
           'param'
          );

use strict;

# this is to fix tainting
sub param($) {
    my ($string) = @_;

    if (defined wantarray and wantarray == 1) {
        my @retval = CGI::param($string);
        for(my $i = 0; $i <= $#retval; $i++) {
            $retval[$i] =~ /(.*)/;
            $retval[$i] = $1;
        }
        return @retval;
    }
    else {
        my $retval;
        $retval = CGI::param($string);  # this is always undef!
        if ($retval =~ /(.*)/) {
            $retval = $1;
        }
        else {
            error ("Bad data in $retval");
        }
        return $retval;
    }
}
[download]

Now when I run it (I've only tried asking for a scalar) then $retval is always undef after calling CGI::param($string). I know that the $string I'm asking for is in the form.

I've also tried calling my sub 'safeparam' and then importing param from CGI into my namespace so that I can call it normally, and that produces the same results.

Does anyone have an idea of why this is happening, or if there is already an untainting CGI wrapper out there?

Thanks,
Dan