in reply to how to avoid web server from getting hacked

For replacing the crontab file, I would use the crontab command:
... open(OUT, "|/usr/bin/crontab -u USER -") or die "open: $!"; print OUT ...new crontab contents...; close(OUT);
See man 1 crontab for more details. This ensures that the file is safely replaced and that the cron daemon is notified of the change.

Unfortunately, you still might have a permissions problem if your web server is not running as USER.