This is unrelated to the problem you're trying to solve right now, (and others are helping with) but does bring up some possible future issues...

<input type="hidden" name="user" value="$user">
<input type="hidden" name="passwd" value="$passwd">
[download]

Hmmm.