Looking at atcroft's script, $query->upload('upload_file') returns a file handle, which the script then reads, saving in a local file, based on the file name sent by the remote user's browser:

my $fh = $query->upload('upload_file');
my $filename = $query->param('name');
$filename =~ s/[^A-Za-z0-9\.\_]/_/g;

open OUTF, "> $directory$filename" or die;
binmode OUTF;
while ( $bytesread = read $fh, $buffer, 1024 )
{
    print OUTF $buffer;
}
close OUTF;
[download]

So, the uploaded file should be in the directory specified by $directory.

On the other hand, $query->param('upload_file') should contain the file content, probably in an encoded form (something like "x-html-form-encoded" or similar).