But please tell me, how is the web user able to manipulate %input?

Possibly I'm mistaken, but it seems to me that the first line of readparse() aliases the local glob *in to the argument of readparse, which is (in this case) the global *input.

readparse(*input);

sub readparse {
    local (*in) = @_ if @_;
    ...
}
[download]

So in fact, the variable %in within readparse is the same as the %input that isotope and jasonk are complaining about.

---

If God had meant us to fly, he would *never* have given us the railroads.
    --Michael Flanders