It's not what should I reject, it's what shouldn't I reject. For example: die "Variable contains dangerous data" if $some_var =~ /[^0-9A-Za-z]/;. As for what should you allow that depends on what your filtering, my example would be pretty safe but would only allow for numbers and characters, you might look at perlre, specifically /Q and /E for how to improve safety.