The problem with using $query->param('xml') is, they can't send an xml= infront of the xml, the second problem is &; will appear frequently in the xml (which is where I'm losing the data with cgi.pm).
As for the use CGI; I just didn't remove it from the example. It makes no difference if I remove it.