Update2: Taint-mode has been brought to my attention. It seems like an excellent way to secure user input. Should it be used in conjunction with the other methods suggested in this node (and comments), or is it good enough by itself?

Taint mode is simply a means for making sure that you actually do use "the other methods suggested." All it does, really, is cause your script to die if/when it tries to do anything it shouldn't do with untrusted data. If you haven't used it yet, but your script is already written in a fully secure way, adding "-T" on the shebang line will make no difference.

If you have forgotten to cover any vulnerabilities, or if you later modify the script and accidentally introduce a vulnerability, having "-T" on the shebang line will make a difference: the script will die with an error message about the nature of the problem.

The one big problem with "-T" is that it can be remarkably easy to disable its usefulness as a safety device, simply by taking inappropriate steps to "untaint" your untrusted data.

Consider the following script, which is potentially quite dangerous to run (so don't use it at all if you don't understand what the risks are):

#!/usr/bin/perl -T

use strict;
use warnings;

$ENV{PATH}="/bin";

while (<>) {
    chomp;
    my $str = '';
    if ( /(.+)/ ) {
        $str = $1;
    }
    system( "echo $str" );
}
[download]

Having taint mode turned on does not stop that script from causing any given amount of damage or mischief, because the regex match, which satisfies the requirements for untainting data, does nothing at all to protect you from the bad things that could happen.