two comments:

1) It doesn't look like your code handles translating + to space

2) You can also use CGI::Util::unescape to decode a single string (and I have a lot of trust that the CGI.pm people did it right :) )