I had forgotten that the input variable $class was tainted because it came from a drop-down menu rather than a text box. In fact before posting I did a search and found a perl Monks node exactly to this effect. I failed to see the connection at the time. Sadly I can no longer find that node. The replies were helpful and broadened my knowledge in other ways.