--- sql2xls.cgi	2008/11/03 20:42:55	14
+++ sql2xls.cgi	2008/11/03 21:53:30	16
@@ -85,7 +85,7 @@
 my $sql_dir = $ENV{SCRIPT_FILENAME} || '.';
 $sql_dir =~ s,/[^/]+$,,;
 
-my $config_path = "$sql_dir/config.pl";
+my $config_path = $1 if "$sql_dir/config.pl" =~ m/^(.+)$/; # untaint
 warn "# using $config_path\n";
 require $config_path if -e $config_path;
 
@@ -116,6 +116,7 @@
 my $dbh = DBI->connect($dsn . $database,$user,$passwd, { RaiseError => 1, AutoCommit => 0 }) || die $DBI::errstr;
 
 sub _c {
+	return shift unless $db_encoding;
 	return decode( $db_encoding, shift );
 }