Rather simple reason that CGI.pm isn't doing what you'd like it to:

Your incomming XML is likely unquoted.

Let's assume you're trying to pass in this small XML string (I'll do the example in GET, since CGI.pm handles GET and POST transparantly): "<xmltag>Tulips &amp; Flowers<xmltag>".

in a get request this is going to look like:
script.pl?xml=<xmltag>Tulips &amp; Flowers<xmltag>

Ick! Since you haven't followed the specs for escapeing URLs, it's going to get nasty.

Get the people who are sending your request to properly escape the data:

my $newval = CGI::escape(qq("<xmltag>tulips &amp; Flowers:</xmltag>));
[download]

$newval will now look more like: %3Cxmltag%3Etulips%20%26amp%3B%20Flowers%3A%3C%2Fxmltag%3E

Which is how it should look if you're following the standards for URL quoting.

Now, using CGI.pm:

use CGI.pm

my $q = new CGI;

my $xml = CGI::unescape($q->param('xml'));
[download]

Voila!