--- a/sap-vpn.pl	Thu Nov 13 22:40:16 2008 +0000
+++ b/sap-vpn.pl	Fri Nov 14 23:07:00 2008 +0000
@@ -17,6 +17,7 @@
 
 use constant ME => basename $0;
 
+
 delete @ENV{ grep /PATH/, keys %ENV };
 $ENV{PATH} = "/usr/local/bin:/usr/local/sbin:/usr/bin:/usr/sbin:/sbin:/bin";
 
@@ -39,8 +40,8 @@
 # name of our Network Access favorite, and our username/pasword.  All of these
 # can be passed as arguments, if desired.
 
-my $opt_user;
-my $opt_passcode;
+my $opt_user     = "";
+my $opt_passcode = "";
 my $opt_host     = 'connectwdf.sap.com';
 my $opt_name     = 'SAP Network Access';
 my $opt_linkname = basename $0;
@@ -49,14 +50,15 @@
 my @ppp_opts     = ();
 my $opt_debug    = 0;
 my $opt_verbose  = 0;
-my $opt_script;
-my $opt_ppp  = 1;
-my $opt_kill = 0;
+my $opt_script   = undef;
+my $opt_ppp      = 1;
+my $opt_kill     = undef;
 
 sub untaint(;$) {
     my $ref = @_ ? \$_[0] : \$_;
+    return $$ref if not defined $$ref;
     my ($x) = ($$ref =~ /([\/\w.-]+)/i);
-    return $$ref = $$ref eq $x ? $x : undef;
+    return $$ref = (defined $x and $$ref eq $x) ? $x : undef;
 }
 
 sub verbose(@) { print STDERR @_ if $opt_verbose }
@@ -101,7 +103,7 @@
     exit do_kill($opt_linkname) if $opt_kill;
 
     untaint($opt_user)
-      or die ME . ": username \"$opt_user\" didn't pass verification\n";
+      or die ME . ": username didn't pass verification\n";
 
     if (not defined $opt_passcode) {
         chomp(my $settings = qx{stty "-g"});
@@ -300,9 +302,9 @@
  sap-vpn [-d|--debug] [-v|--verbose] [--[no]ppp] 
      [-o|--opt <ppp option>]
      [-l|--linkname <link name>]
-     [-u|--user <user>] [-p|--passcode <passcode>]
      [-H|--host <host>]
      [-s|--script <script>]
+     -u|--user <user> -p|--passcode <passcode>
 
  sap-vpn [-l|--linkname <link name>] -k|--kill
 
@@ -363,7 +365,7 @@
 =item B<-p>|B<--passcode> I<passcode>
 
 Your passcode, if not supplied, F</dev/tty> is opened for reading
-the passcode. (no default)
+the passcode. Not really optional. (no default)
 
 =item B<--[no]ppp>