my $HOST_OK_CHARS='-a-zA-Z0-9_.öüäÖÜÄ';
  ...
  my $query = new CGI;
  $query->charset('UTF-8');
  ...
  my $hostname  =$query->param('hostname');
  $hostname =~ s/[^$HOST_OK_CHARS]/_/go;