perl -MCGI=param -le "print for param('title')" ?title=foo;title=bar foo bar #### use strict; use Data::Dumper; use CGI; my $q = CGI->new('?title=foo;title=bar;title=injected_key;title=injected_value'); my $query = { title => $q->param('title') }; print Dumper $query; __END__ # Outputs: $VAR1 = { 'injected_key' => 'injected_value', 'title' => 'bar' };