sub untaint_username
{
    my $tainted = shift;

    # remove non-alphanumerics
    $tainted =~ y/a-zA-Z0-9//cd;
    # or s/[\W_]//g

    # must be 1-16 characters
    return "$1" if $tainted =~ /\A(.{1,16})\z/;
    print "failure\n";
    return;
}