You have several options:

• You can use $ENV{HTTP_REFERER} (or more simpler $cgi->referer) to make sure that your script is being submitted from the right place.
• You could do a MD5 checksum of all the hidden fields to makre sure they haven't changed
• You could use something like CGI::EncryptForm to encrypt the data so it can't be changed
• You could not store anything in hidden fields and use sessions instead (see Apache::Session)

You definatly don't want to accept things like prices from form fields (I know of one major e-commerce system that does).

Hope this helps.

gav^