use strict;
use warnings;

my $str = q{<tag refid="5,8,7,3,2,1">};

sub sort_and_reformat {
    my $s = shift;
    return join " ", sort split m/,/, $s;
}

$str =~ s/"([^"]*)"/'"' . sort_and_reformat($1) . '"'/eg;
print $str, $/;