Can anyone help me make uploading files from a webform more secure? I know i have to watch for backticks, ., .., and such.............is there a simple regex that covers all this? I recall seeing one before but I can't seem to find it........thanks

#!/usr/bin/perl -w

$| = 1;

use CGI qw(param);
use strict;

my $file = param("file");
my @file_name = split(/\\/,$file);
my $file_name = pop(@file_name);
my $max_file_size = 2000000;
my $base_dir = "/home/ducc/";
my $out_file = $base_dir . $file_name;
my $log_file = $base_dir . "upload.log";
my ($total_bytes_read, $ip_log, $time_log);

print "Content-type: text/html\n\n";
open (OUT, ">$out_file") || die "Can't open: $!";
open (LOG, ">>$log_file");
  while (my $bytes_read = read($file, my $buffer, 1024)){
    $total_bytes_read += $bytes_read;
    $ip_log = $ENV{'REMOTE_ADDR'};
    $time_log = scalar localtime;
      if ($bytes_read > $max_file_size){
        print "ERROR: The file you tried to upload is will not be uplo
+aded<br>";
        print "Your file is: $bytes_read bytes<br>";
        print "The max file size you can upload is $max_file_size byte
+s<br>";
        close (OUT);
        unlink ($out_file);
        print LOG "ERROR: $time_log: $ip_log tried to upload $out_file
+ that was $bytes_read bytes\n";
        die "$time_log: $ip_log tried to upload a file > $max_file_siz
+e";
      }else{
        print OUT "$buffer";
        print LOG "$time_log: $ip_log uploaded $out_file that was $byt
+es_read bytes\n";
      }
  }
close (OUT) || die "Can't close: $!";
close (LOG);

print "Completed uploading $file_name: $total_bytes_read bytes<br>";
print "Done...";
[download]