Andy -- what was the is_tainted from your talk last night? The is_tainted from the most recent perlsec isn't the same: sub is_tainted { return ! eval { eval("#" . substr(join("", @_), 0, 0)); 1 }; } but I recall that the one on your slide seemed to make more sense. -- Mike F.