--- sql2xls.cgi	2008/11/03 20:42:55	14
+++ sql2xls.cgi	2008/11/03 21:39:44	15
@@ -85,7 +85,7 @@
 my $sql_dir = $ENV{SCRIPT_FILENAME} || '.';
 $sql_dir =~ s,/[^/]+$,,;
 
-my $config_path = "$sql_dir/config.pl";
+my $config_path = $1 if "$sql_dir/config.pl" =~ m/^(.+)$/; # untaint
 warn "# using $config_path\n";
 require $config_path if -e $config_path;