if ($data =~ /^([-\@\w.]+)$/) {
    $data = $1;             # $data now untainted
    } else {
    die "Bad data in '$data'";  # log this somewhere
    }