Re^4: Calling perl from CGI

[Anonymous Monk]

is free of security concerns.
Not really :) $module is still tainted, and can be abused in the same way ('strict; system qw[ rm -rf / ];')needs to be validated, something like

$module = $1 if /^([a-zA-Z_][a-zA-Z_0-0]*(?:(?:'|::)[a-zA-Z_0-0]+)*)$/
+s;
# or

$module = $1 if /\A[^\W\d]\w*(?:(?:\'|::)\w+)*\z/s;