in reply to Should be simple, What don't I see?

use strict;
use HTML::Entities ();

my $firstName = 'first';
my $lastName = 'last';
my $email = 'email@email.com';

# do it The One Correct Way
print HTML::Entities::encode("$firstName $lastName <$email>");

[download]
See also: perl.com: Preventing Cross-site Scripting Attacks

Makeshifts last the longest.

In Section Seekers of Perl Wisdom