Not an answer to your problem, but are you sure that name => (param("photo$_") =~ /.+([\w. ]+)/)[0] does what you think it does? It simply stores the last charachter which is a letter, a number or a space under the hash key "name", because the first + is greedy and just gives up the last character in the character class so that the second + is satisfied. If you want to discard the first part, which does not contain these characters (I don't know your data), then think about a negated character class, along the lines of name => (param("photo$_") =~ /.[^\w. ]+([\w. ]+)/)[0]. But maybe I am mistaken anyways and this does what you intend to do.
To your problem: CGI facilitates your HTML output (just from the docs, I could never use it) by providing some interesting functions. Have you tried

print header, 
      start_html(-head=>meta({-http_equiv => 'refresh',
                              -content    => "01; URL=http://eoinmurph
+y00.netfirms.com/cgi-bin/albums.cgi?status=viewall&album=$album&user=
+$user"}));
[download]

yet?
Cheers, CombatSquirrel.

---

Entropy is the tendency of everything going to hell.