Thanks for pointing out the possibility of a single quote in $v -- I hadn't thought of that, because most (but not all) of these scalar and array values $v will be limited to a restricted set of characters. All $k are already restricted by the grammar to a limited set of characters allowed in identifiers, so $k itself isn't an issue.

The goal is not to foil malicious code, merely to prevent people from shooting themselves in the foot, unless they really intend to. An errant single quote is the exact type of error I'd like to handle well.

Thanks.

Update: If Alias.pm didn't throw error messages during normal operation, using it in a separate module would suffice (a combination of implementations 1 and 2).