You're creating closures. %SENTDATA is a lexical (my) variable, and check_login_input() will keep a private copy of the first version it sees in there. It works some of the time because you have multiple Apache processes going here and some of them saw it with data the first time while others saw it empty.

To fix this, either make %SENTDATA a global (use vars) or pass it to your subroutines (by reference).