And just to be on the safe side

my %field;
for ( qw/foo bar baz/ )
{
  $field{ $_ } = param( $_ );
}
[download]

This way we are explicitly allowing the things we want, and can even build in error handling if the things we need aren't there.