Most of what I'd say has been commented on already. However I just wanted to remind you of the escapeHTML function. It's quite good at what it does so you could replace some of your code with:

foreach my $in ($message, $name, $mail)
{
     $in = $q->escapeHTML($in);

    # and of course you can do your subs here to:
     $in =~ s/\(b\)/<b>/ig;  # ...
}
[download]

The escapeHTML function is of course provided by CGI.pm. It doesn't come with the :standard set use CGI qw/:standard/; so if you want to use it that way you have to include it use CGI qw/:standard escapeHTML/;. This of course is not an issue if you're using CGI.pm with its object interface (as I have assumed above).

Remember that that $in in the foreach loop is an alias to the elements in the list we've created. So for the first iteration of the loop, $in is the same as $message and everything you do to it is done to $message.

You also might be interested in looking at Damian Conway's Regexp::Common module as it has a very elaborate smut filter that would save you having to write one of your own.