Thank you for taking time to reply. That might work in some environments, but it assumes that all of the servers use the same path prefix (/var/www). I don't believe that's true in our case. I suppose I could include a note in the installation instructions that the application name must be the final directory element in the AppBAse environment variable. Then I could use a regular expression something like this:
That should be sufficient to satisfy the untainting requirement, but I'm not sure whether it really makes the value "safe". Thanks again for responding so quickly.