Now your code only references an URL that I cannot fetch data from. Maybe show some representative XML which still produces the error?

Also, you don't need CGI anymore.

Please show the XML and the output you get. Also consider using Data::Dumper do inspect the data structure that XML::Simple returns:

print Dumper $ref;

Dumper data is.

$VAR1 = {
          'firstname' => [
                           "\x{422}\x{430}\x{43c}\x{438}\x{440}"
                         ],
          'xmlns' => 'http://tempuri.org/',
          'photo' => [
                     'https://sisi.num.edu.mn/getstpic.ashx?id=1001004
+0666'
                   ],
          'lastname' => [
                          "\x{414}\x{443}\x{43b}\x{430}\x{43c}\x{446}\
+x{43e}\x{4
3e}"
                        ],
          'phones' => [
                      '94120465,99465510'
                    ],
          'usertype' => [
                        '1'
                      ],
          'program' => [
                       "\x{411}\x{438}\x{437}\x{43d}\x{435}\x{441}\x{4
+38}\x{439}
\x{43d} \x{441}\x{443}\x{440}\x{433}\x{443}\x{443}\x{43b}\x{438}\x{439
+}\x{43d} \
x{435}\x{440}\x{4e9}\x{43d}\x{445}\x{438}\x{439} \x{441}\x{443}\x{443}
+\x{440}\x{
44c} \x{445}\x{4e9}\x{442}\x{4e9}\x{43b}\x{431}\x{4e9}\x{440} (\x{411}
+\x{430}\x{
43a}\x{430}\x{43b}\x{430}\x{432}\x{440}\x{44b}\x{43d} \x{4e8}\x{434}\x
+{440}\x{43
8}\x{439}\x{43d} \x{441}\x{443}\x{440}\x{433}\x{430}\x{43b}\x{442} - -
+         )
"
                     ],
          'registerNr' => [
                          "\x{416}\x{42f}92101936          "
                        ],
          'xmlns:xsi' => 'http://www.w3.org/2001/XMLSchema-instance',
          'abbrevm' => [
                       "\x{41c}\x{423}\x{418}\x{421}, \x{411}\x{441}"
                     ],
          'userStatus' => [
                          "\x{421}\x{443}\x{440}\x{433}\x{443}\x{443}\
+x{43b}\x{4
38}\x{430}\x{441} \x{447}\x{4e9}\x{43b}\x{4e9}\x{4e9}\x{43b}\x{4e9}\x{
+433}\x{434
}\x{441}\x{4e9}\x{43d} - \x{4e8}\x{4e9}\x{440}\x{438}\x{439}\x{43d} \x
+{445}\x{4a
f}\x{441}\x{44d}\x{43b}\x{442}\x{44d}\x{44d}\x{440}"
                        ],
          'sisiid' => [
                        '13B1SES2361'
                      ],
          'emails' => [
                      'sumiyad@yahoo.com, tamiraa1019@gmail.com'
                    ],
          'xmlns:xsd' => 'http://www.w3.org/2001/XMLSchema',
          'school' => [
                      "\x{411}\x{438}\x{437}\x{43d}\x{435}\x{441}\x{43
+8}\x{439}\
x{43d} \x{441}\x{443}\x{440}\x{433}\x{443}\x{443}\x{43b}\x{44c}"
                    ]
        };
[download]

The xml is

<to_user_info>
    <photo>https://sisi.num.edu.mn/getstpic.ashx?id=10010040666</photo
+>
    <lastname>&#1044;&#1091;&#1083;&#1072;&#1084;&#1094;&#1086;&#1086;
+</lastname>
    <firstname>&#1058;&#1072;&#1084;&#1080;&#1088;</firstname>
    <sisiid>13B1SES2361</sisiid>
    <school>&#1041;&#1080;&#1079;&#1085;&#1077;&#1089;&#1080;&#1081;&#
+1085; &#1089;&#1091;&#1088;&#1075;&#1091;&#1091;&#1083;&#1100;</schoo
+l>
    <abbrevm>&#1052;&#1059;&#1048;&#1057;, &#1041;&#1089;</abbrevm>
    <program>&#1041;&#1080;&#1079;&#1085;&#1077;&#1089;&#1080;&#1081;&
+#1085; &#1089;&#1091;&#1088;&#1075;&#1091;&#1091;&#1083;&#1080;&#1081
+;&#1085; &#1077;&#1088;&#1257;&#1085;&#1093;&#1080;&#1081; &#1089;&#1
+091;&#1091;&#1088;&#1100; &#1093;&#1257;&#1090;&#1257;&#1083;&#1073;&
+#1257;&#1088; (&#1041;&#1072;&#1082;&#1072;&#1083;&#1072;&#1074;&#108
+8;&#1099;&#1085; &#1256;&#1076;&#1088;&#1080;&#1081;&#1085; &#1089;&#
+1091;&#1088;&#1075;&#1072;&#1083;&#1090; - -         )</program>
    <registerNr>&#1046;&#1071;92101936</registerNr>
    <phones>94120465,99465510</phones>
    <emails>sumiyad@yahoo.com, tamiraa1019@gmail.com</emails>
    <userStatus>&#1057;&#1091;&#1088;&#1075;&#1091;&#1091;&#1083;&#108
+0;&#1072;&#1089; &#1095;&#1257;&#1083;&#1257;&#1257;&#1083;&#1257;&#1
+075;&#1076;&#1089;&#1257;&#1085; - &#1256;&#1257;&#1088;&#1080;&#1081
+;&#1085; &#1093;&#1199;&#1089;&#1101;&#1083;&#1090;&#1101;&#1101;&#10
+88;</userStatus>
    <usertype>1</usertype>
</to_user_info>
[download]

So, now, do your $firstname and $lastname contain what you expect?

If they don't contain what you expect, please tell us what they contain.

If they contain what you expect, the error is either in your call to AddMember or it is in how you display/inspect the results after AddMember.