A better protection is the usage of placeholders, as demonstrated in the DBI documentation:

my $query = $dbh->prepare(= "select name, pass from unpw where name = 
+?");
# no checking needed here:
$query->execute($entered_un);
[download]

(Additionally, even if the DBD doesn't support bind variables, the DBI still provides quote(), which will probably do a 100% better job than a hand-rolled regex any day.)

-Paul

In danger of going OT, but could not resist the chance to share this picture (commentary is in Spanish but yuo get the idea). It is a number plate with the text  'OR 1=1; -- ...designed to effect a SQL injection attack on ANPR cameras!

How very cool ;-)

I assume you also know about Bobby Tables?

That's still trivial to bypass: q{us' or 'x' == 'x}. Better is to use placeholders and not let the SQL parser see user input to begin with.

Update: Or worse if the database in question allows compound statements, q{us'; drop table unpw; --}

Just a few of the many recent nodes you may find interesting:

• Prevent SQL Injection
• Securing DB transactions with user form input
• Preventing SQL injection attacks: are -T and placeholders not enough?
• Preventing SQL injection attacks: Placeholders are enough for MySQL, Postgresql and SQLite
• Preventing MySQL Injection
• Simple question on SQL Injection

Or, to simplify, as jhourcle says:

[J]ust use placeholders.

Use the regex to untaint the user-entered string:

my $GOOD_NAME = qr/^(us\w*)/i;

my ( $accepted_name ) = $entered_un =~ /$GOOD_NAME/
    or die "Unacceptable input: $entered_un";

$sql = "select name, pass from unpw where name = '$accepted_name'";
[download]

$sql = "select name, pass from unpw where name = '$accepted_name'";
[download]

No, please don't recommend that. As Fletch writes above, that's still trivial to bypass. It's far too easy to write a regexp that will slip something unwanted through, which would, when not combined with placeholders or DBI::quote, represent a security risk.

Use placeholders.

Update: Revoked statement on triviality.

--
No matter how great and destructive your problems may seem now, remember, you've probably only seen the tip of them. [1]