I hope the users are not using funny passwords as for instance ";rm -Rf /;"!!!

Instead of the backquote operator it is safer to use system @array to call external programs:

system ('wget',
        "--http-user=$username",
        "--http-password=$password",
        "--no-check-certificate",
        "--output-document=$path",
        $url);
[download]

That way special characters are not expanded and/or interpreted by the shell in unexpected ways.