It also makes it easier for the potential intruder to wreak havoc with your script.

Never ever use user input to determine a variable name!

Consider what happens when a malicious abuser of your script submits a field name of, for example, mailhost, dbname or maybe simply adminmail - this method would directly overwrite the variable of that name, and it's just a matter of determination until the abuser finds out a combination that works for their purposes.

For the bare minimum, you should check that each parameter is in your scripts list of known good parameters, and you most definitively must use taint mode (#!/usr/bin/perl -wT as the first line of the CGI script) to alert you of more pitfalls when handling insecure data.

My approach would be to either use CGIs feature of importing the parameters into their own namespace or simply use the param() function where appropriate. Wildcarding the field names will give you much pain in the future.

perl -MHTTP::Daemon -MHTTP::Response -MLWP::Simple -e ' ;    # The  
$d = new HTTP::Daemon and fork and getprint $d->url and exit;#spider
($c = $d->accept())->get_request(); $c->send_response( new   #in the
HTTP::Response(200,$_,$_,qq(Just another Perl hacker\n))); ' #  web
[download]