i would suggest restricting the scope of the "pass" variable like this :

my $pass = crypt($q->param('old'), r);
[download]

this will ensure that every time the "change_pass" subroutine is called, the "pass" variable will be re-initialized...