You check the QUERY_STRING_UNESCAPED environment variable. It will contain the parameter list that is provided to the page, as opposed to the parameter list that is sent with your SSI.

You then take away the backslashes in QUERY_STRING_UNESCAPED and force-feed it to CGI.pm (if you are using CGI.pm, that is). You may also want to check that your dealing with the same ID in the query strings, in case if you (like me) want to have several embedded cgi scripts as SSIs in one page. ID is "poll_id" in the code below:

unless ($ENV{"REQUEST_METHOD"} eq "POST") {
        my $url_query_string = $ENV{'QUERY_STRING_UNESCAPED'};
        $url_query_string =~ s§\\§§g;
        $url_query_string =~ m§poll_id\=([\d_]+)§;
        my $poll_id = $1;
        $ENV{'QUERY_STRING'}=~ m§poll_id\=([\d_]+)§;
        my $ssi_poll_id = $1;
        # if there is a dicrepancy between the two query string vars, 
+and 
        # there is actually something in
        # ENV{'QUERY_STRING_UNESCAPED'}, it's because the cgi is calle
+d as an SSI, 
        # but with arguments on the url,
        # and then we want CGI to use those instead
        # "not $cgi_parameters" below handles if we get params from a 
+test harness script
        if ($url_query_string and $url_query_string ne $ENV{'QUERY_STR
+ING'} and not $cgi_parameters and $poll_id eq $ssi_poll_id) {
            $cgi_parameters = $url_query_string;
        }
    }

my $q = new CGI($cgi_parameters);
[download]

/jeorgen