Using the 3-parameter form of open would be a good practice to check for. It would be good to warn about system or exec calls that pass arguments inside the first parameter (i.e. system("$command $arg1 $arg2") instead of system($command, $arg1, $arg2)).

If practical, warning about DBI statements that use inline variables where prototypes are better (i.e. $dbh->prepare("update table set my_val = $somevalue") instead of $dbh->prepare("update table set my_val = ?")). I'm guessing that would be a challenge, but it sure would be nifty.

Yes, proper untainting would probably solve these issues, but I've seen too many coders untaint such things extremely poorly.

Using the 3-parameter form of open would be a good practice to check for.

There's a InputOutput::ProhibitTwoArgOpen in the Perl::Critic distro already..

The DBI one would be a 'challenge' :) .. not sure how it'd be possible to distinguish between $dbh->prepare("update table set my_val = $somevalue") (NOT OK) and $dbh->prepare("update $TABLENAME set my_val = ?") (OK) without actually parsing the sql .. plus there's the circumvention of $sql = "update table set my_val = $somevalue"; $sth=$dbh->prepare($sql); as well (or can you back-trace that w/PPI?)..

I took a crack at the system/exec one (see RFC: Perl-Critic policy: ProhibitInlineSystemArgs), though i think there's problems catching all of those, too.. e.g. system( join(" ", $cmd, @args) )

You should be able to glean many security tips and tricks from:

• pjf's excellent perl security course notes, Perl Training Australia's Security notes released
• Juerd's Security techniques every programmer should know