When your code is untainting $argv1 after the tainted value has been copied into $data{'email'}, why would you expect the database interaction to change?

That was rather stupid of me wasn't it?!?
No answer required...

That's what comes of trying to do something quickly last thing at night before bed. A combination of tiredness and rushing is always bound to lead to stupid mistakes. I should know this...