I'd do it with an allow list and substitution:

$my_var =~ s/[^a-zA-Z0-9_@#$%]//g;
print "Bad length!" unless (length $my_var >= 8) && (length $my_var <=
+ 12);
[download]

This will remove all illegal characters, then complain if what's left is outside of the desired size range.