you use $form but do not declare it or populate it anywhere. Perhaps you meant to do:

    my $form = $query->Vars;
[download]

first?

If you did, remember this from the CGI perldoc:

When using this, the thing you must watch out for are multivalued CGI parameters.

Because a hash cannot distinguish between scalar and list context, multivalued parameters will be returned as a packed string, separated by the ``\0'' (null) character.

You must split this packed string in order to get at the individual values. This is the convention introduced long ago by Steve Brenner in his cgi-lib.pl module for Perl version 4

Thats from the 'FETCHING THE PARAMETER LIST AS A HASH:' section.