The biggest difference is that the script is seperated from the html and uses redirects to push the user around to success/fail pages.
As I said in my last post, after looking at the source I wouldn't have even considered using it, but this friend had already built his HTML around it and would have figured out how to make it work without me (the shebang line was wrong), so I figured I might as well do what I could. I am fully aware that using strict, the CGI module, warnings, and taint do not make a script secure. However, it probably won't hurt. In addition, I made changes to the script's broken input validation and a few regexes that weren't as solid as the original coder probably thought they were. In the end I know for a fact that I closed one security hole and I am reasonably sure that I didn't introduce any new problems.