regex - I believe this Perl script is secure. Can it be improved? -

I have the following Perl script one (not yet because I took it down) a URL like

Click on

  http://www.joereddington.com/testsound/getsound.pl?text=hello%20mum  

and then find the file

  http://www.joereddington.com/testsound/hope.wav  

There is a recording of computer voice "Hello mother"

 < Code> #! Use / usr / bin / perl strict; Use warnings; Use CGI qw (: standard-debug); My $ text = param ('text'); $ Text = ~ s / [^ 0-9a-zA-Z \ s] // g; Print "content-type: text / html \ n \ n"; System ("/ home8 / projedf4 / tts / espeak-1.48.04-source / src / speak \" $ text \ "-w hope.wav");  

I am a little worried about users possibly taking advantage of injection attacks and in this way I believe I have done enough with the line

  $ text = ~ s / [^ 0-9a-zA-Z \ s] // g;  

Because I'm just really removing everything that can harm the string.

But is it enough? I as far as

  $ text = ~ s / [^ 0- 9a-zA-Z \ s \.], / G;  

Yes, your code is correct ( perl , < Code> Talk , DOS Invasion, etc.), specializing in - with speaking assessing only one argument.

But it can be improved.

1. There is no need to remove so many letters.

     sub-x00 /; My $ lit = $ _; $ Litt = ~ s / '/' \\ '' / g; "'$ Row' '' '@_}} $ Text = ~ s / ^ - + //; system (shell_kot (' /.../bol ', $ text,' -va ',' hope. ') );  

   or

     Use string: Shell quat quad (shell_kota); $ Text = ~ s / ^ - + //; system (Shell_kot ('/.../bol', $ text, '-va', 'hope.' '));  

2. Launch a shell too Do not need to.

     If $ text = ~ / \ x00 /; $ Text = ~ s / ^ - + //; system ('/.../bol', $ Text, '-va', 'hope.');  

3. If your supports supports - , you can also use If the $ text = ~ / \ x00 /; system ('/.../bol', '-va', 'hope', '' ',' $ text, if die;

   );