I never knew about getting a list from param.

Reading the documentation really helps.

syntax error at upload.cgi line 73, near "while <$pic_filehandles[$cntr]>"

You should use parentheses with while. Again, you should read the documentation.

Also could you please elaborate on your comment about checking the folder before using it.

Try to see what happens if the web users specifies "../hello_world" as the album.

Juerd # { site => 'juerd.nl', plp_site => 'plp.juerd.nl', do_not_use => 'spamtrap' }