in reply to request for review: file reading security

It isn't only the security. Your line $req = 'index' if -e $req; will make all requests invoke "index". Your code means " assign to 'index' if a file named $req exists". I am not sure what you wanted to achieve that way, but here is how I would do it.

use strict; use warnings; my $req = $ENV{QUERY_STRING}; # limits the applicability. Only lowercase file names $req = lc $req; # remove all unwanted characters from the beginning of the string. # In this example, everything except alphanumerics # and underscore is removed. $req =~ s/^[^a-z_0-9]+//; # remove an extension, if any $req =~ s/\.html$//; # default value is the index my $page = "pages/index.html"; # if the page exists, then we use it $page = "pages/$req.html" if -e "pages/$req.html" ;

Also, consider using CGI param instead of reading the environment.