I don't know anything about the security aspect of it, but I was curious about which one was faster, so I ran a benchmark...
Copying about 1.5MB:
Benchmark: running File::Copy::cp($a, $b), system('cp', $a, $b) for at
+ least 3 CPU seconds...
File::Copy::cp($a, $b): 4 wallclock secs ( 0.17 usr + 3.18 sys = 3.
+35 CPU) @ 339.70/s (n=1138)
system('cp', $a, $b): 29 wallclock secs ( 0.13 usr 3.21 sys + 1.43 c
+usr 24.26 csys = 29.03 CPU) @ 965.27/s (n=3224)
I'd like to admit that I don't quite know how to parse the results. It looks like the system command incurs a 1.43 cusr and 24.26 csys penalty--what is that?