Like everyone said above me CGI or a module alike for your form inputs, but as i look at your code your getting the file name from a form input so using taint or make sure that name does not go out of its boundary's.

Unless you are 100% sure that only trusted people will be using that code only.