I have over 20k lines of code currently using param(), so I don't really want to go through it all and use the module Untaint individually each time.

Then don't bother turning on tainting if you're not using it. That's like painting a big lock on your door saying "I'm safe now".

Really. I'd reject your code in a heartbeat at a code review if I saw you were using global untainting without regard to the valid content of the fields. Bleh!

-- Randal L. Schwartz, Perl hacker