If you read my first reply you'd see this has nothing to do with passing data from CGI, or DBI. I demonstrate that you're stripping the zeros ($mob =~ s/[:;$%&@<>?]//gi;). My example shows that basic debugging will show you that your code isn't doing what you think it is. If you're going live with some critical service tomorrow (as you mentioned) this would be a warning flag for me regarding what you're delivering. For the immediate issue consider the solution presented by poj.