First off, you really should not be reinventing the wheel; CGI.pm does all this for you and has been put through the security wringer more than enough times to be proven safe.

Secondly, assuming you stay with this solution is that you are assuming that the form elements will be returned in the QUERY in a specific order. I can't find anything in either the CGI or the HTTPD specifications on order, and while I'd suspect most browser return these fields in the order they were defined in the HTML document, this is not a guarentee. I would verify your form name before arbitarily assigning it to what you believe it is.

To simply check for empty fields, just use $candidate eq ''.

-----------------------------------------------------
Dr. Michael K. Neylon - mneylon-pm@masemware.com || "You've left the lens cap of your mind on again, Pinky" - The Brain
"I can see my house from here!"
It's not what you know, but knowing how to find it if you don't know that's important