#!/usr/bin/perl -Tw
use strict;
use CGI;

my $query = new CGI;
$query->param('thing') =~ /^([\w\s\d]+)$/ or die "Tainted data in thing!";
my $thing = $1;