The semicolon is the lesser known valid parameter separator. If you dump your CGI object, you'll probably see all the data after the first semicolon (take a look at the parse_param method in CGI). Is the xml the only data coming in the submit? If so, your best bet is to see the HANDLING NON-URLENCODED ARGUMENTS section of CGI.