That's not correct, but its one of the ways you need to un-taint input; run it through a safe-making RE and use only the matched part.$name = param('name'); $name =~ /(\w+)/; $safe_name = $1; # use $safe_name from here on out
a
| For: | Use: | ||
| & | & | ||
| < | < | ||
| > | > | ||
| [ | [ | ||
| ] | ] |