OK remember when I said "huge chunks of your code are missing"?

One huge chunk is still missing. The bit that receives the results of the form and processes them. I'm guessing you're using something like the Visual QuickStart Guide subroutine Parse_Form, from the name of the hash it creates, %FORM? You should put it back in. But then you should take it out again and start using CGI.pm to handle your form input.

But your HTML is so broken that I had to close a bunch of quotes and so on before I could even get a usable page out of this code. Check your BODY tag, it's a mess of unclosed quotes. You need to start using Here Documents, or maybe qq(), for printing out tons of HTML.

And even when you've fixed all that, it still doesn't work, because you're doing this:

if($_ =~ m/^$FORM{'sortbyform'}/i)
[download]

and 'sortbyform' is just the name of the form.

What you, or whoever wrote this, intended, is presumably

if($_ =~ m/^$FORM{'sortby'}/i)
[download]

which is the name of the select menu, where the form-processing code you don't have would put the result of that form being submitted.

I don't feel up to it, but I really think someone should give Anonymous Monk a brief lecture on security at this point?
--
“Every bit of code is either naturally related to the problem at hand, or else it's an accidental side effect of the fact that you happened to solve the problem using a digital computer.” M-J D