The param function in CGI.pm already does all
of this. It also handles other eventualities that you don't
seem to have thought of (for example, what does your code
do when the same CGI parameter appears twice?)
Nice piece of work, but it seems like a reinvented wheel again. Should be easier and safer to use cgi; (As I said before elsewhere, see my homenode about it!