open($fh, '-|', ...) is no more secure than backticks if the command has no args. Have a look at IPC::System::Simple's capturex.