A side note here, I don't see any taint checking in your script. You might consider adding a line like this, assuming you allow no special characters:

die "Invalid returned_param" if $returned_param =~ /[^0-9a-zA-Z]/;
[download]

before the s/\d//g line. Ovid's course explains this much better then I every could.