First, it would be highly advisable to start your Perl script like this:
#!/usr/bin/perl -T
use strict;
use warnings;
I know you used warnings with the -w flag already, but adding strict will help with debugging as well. Also, you "MUST" use the -T flag as shown to enable taint mode, or mistakes in your code could turn into gaping security holes. DO NOT leave all your folders and files at the 755 permission setting. Only a CGI script you want to be executable by a HTTP request should have these permissions. All other files should not allow anything else but read permission to "other" or "world" users (i.e. 4 as the last permission digit).
If there is a file called something like "cgierror.log" in the "logs" directory on the server, compile and run time errors may be collected here. You have not validated the user input sufficiently before passing it to open. This
$filename =~ s/.*[\/\\](.*)/$1/;
means, match some stuff then capture anything any number of times and set $filename to this. This means someone could pass virtually anything into open(FILEHANDLE,....). Including of course ">my_file", which will delete the contents of any file a hacker chooses. Instead try,
my $filename =~ /([^<>]*)/;
$filename = $1;
open(FILEHANDLE, "<", $filename);
The regex will remove any shell meta characters (<>) from the name supplied. I think it's best to use the three parameter form of open shown, as it's safer by not allowing user data to set the open mode. Finally, if it's just a text field you want to gather with your form, put:
<input type="text" name="song">
I don't think type="file" is valid HTML.
Steven.
Offline 
Unsolved 
