Possibly try using the quotemeta function which backslashes all non-"word" characters. This might work for you:

my $set_password = qq(/usr/bin/ssh $targethost "echo ')
                 . quotemeta($new_password)
                 . qq(' | /usr/bin/passwd --stdin $username");
system($set_password);
[download]