use File::Basename;

my $query = CGI->new();
my $basename = basename( $query->param('filename') );
my $file_name = $query->param("id").$query->param("auftrag").$basename;

$file_name =~ s![^\w.-]!_!g;