use CGI qw(a);
use HTML::Entities qw(encode_entities);
use URI::Escape qw(uri_escape);
my $URL_PATH = "http://my.server.com/path/to/pictures";
my $REAL_PATH = "/home/web/htdocs/path/to/pictures";

... [print the normal CGI stuff up here]...
opendir DIR, $REAL_PATH;
my @images = sort grep /\.(png|gif|jpe?g)$/ readdir DIR;
closedir DIR;

print join ", ", map a({href =>
  encode_entities(uri_escape("$URL_PATH/$_"))},
  encode_entities($_)), @images;