Baz,

This kind of thing is very important when using Perl for CGI and certain other applications (use SuperSearch to check up on the -T switch or taintchecking.)

Basically the way to do it is using regexps or one of the various modules listed above. The key is the philosophy with which you approach the problem - the way I think it should be done is that ANYTHING which is not expressly allowed should be forbidden: If, for example, you want to use some entered text for a message book then you should strip ALL characters except A-Z, a-z, 0-9 ,!. and maybe? This heads off just about any kind of problem because no tags such as the potential nasty <javascript> javascript code</javascript> can get through. If in doubt, write some code and post it here and ask for comment, I'm sure that the gods will not be upset.

Hope this helps.

"A nerd is someone who knows the difference between a compiled and an interpreted language, whereas a geek is a person who can explain it cogently to a non-geek over a couple of beers" - Elgon