While I agree that using CGI.pm is the way to go for this, especially for parsing multipart data, a bit of theory may help. For a better description of this, you'd probably want to check out rfc 1867.

Once you start using multipart data, the normal reading from STDIN and grabbing $ENV{CONTENT_LENGTH} bytes doesn't work any more. Multipart data instead uses the idea of a boundary to delimit the different fields on a form. A boundary looks like you described, a series of hyphens followed by a unique string of numbers and letters. If you do read in just the CONTENT_LENGTH amount of bytes, you'll just get this boundary.

If you really want to get a look at what the data looks like, you'll want to do something like

read(STDIN, $form_data, 10000000); #just get everything
[download]

Once you get a look at what the actual multipart data looks like, I'm sure you'll reach the same conclusion I did when I considered writing a CGI parser to handle this type of thing a while back: it's really not worth it.