sub text_to_shell_lit(_) {
   return $_[0] if $_[0] =~ /^[a-zA-Z0-9_\-]+\z/;
   my $s = $_[0];
   $s =~ s/'/'\\''/g;
   return "'$s'";
}

my $mysqldump_cmd = join ' ', map text_to_shell_lit,
   mysqldump => (
      '--add-drop-table',
      '-u'.'root',
      '-p'.'password',
      'mydatabase',
   );

my $gzip_cmd = join ' ', map text_to_shell_lit,
   gzip => ( '-9c' );
   
my $output_file_lit = text_to_shell_lit("$backup_dir/mydatabase.sql.gz");
   
system("$mysqldump_cmd | $gzip_cmd > $output_file_lit");