• Store the shell literal in the config.

  my $password = '...';  # Not the password, but a shell literal of the 
  +password.
  system( ... "-p$password" ... );
  [download]

• Pretend the config is a shell literal.

  my $password = '...';
  system( ... "-p$password" ... );  # Pretend $password is a shell liter
  +al.
  [download]

• Embed the config data in the command

  system( ... "-p..." ... );
  [download]

Every one of these are very unappealing to me.

The only issue that cannot be resolved by single quoting relevant parts of the command line is of escaping single quotes. Either do this manually, or do something simple like this:

s#'#'\\''#g for ($password, $path);
system("mysqldump --add-drop-table -uroot -p'$password' mydatabase | g
+zip -9c > '$path'");
[download]

Update: s/// command corrected as per ikegami.

I prefer

my ($passwd_lit, $path_lit) = map text_to_shell_lit, $passwd, $path;
system("mysqldump --add-drop-table -uroot -p$passwd_lit mydatabase | g
+zip -9c > $path_lit");
[download]

to

my $passwd_lit = $passwd;
my $path_lit   = $path;
s#'#'\\''#g for $passwd_lit, $path_lit;
system("mysqldump --add-drop-table -uroot -p'$passwd_lit' mydatabase |
+ gzip -9c > '$path_lit'");
[download]

but to each his own.

By the way, your quoting was buggy. "\" is not special in sh single-quoted literals.