ditto...use CGI.pm or similar--or be at the peril of code injection inside URLs. You should also use taint...and check (with a simple regex) that the parameters you receive are alphanumeric only (no quotes etc.) Chris