1. For the purposes of untainting, do I have to validate every user input value, even though they are all going into a database? I.e., is it overkill? Or is it just good practice? (I know I won't get any errors unless I try to open, eval, etc.)

When validating untrusted user input, there's not much that could be called "overkill".

For starters, see tilly's recent node: Use placeholders. For SECURITY! Consider also whether, the data will ever be used for anything else. It might just be going into a database right now, but what are you going to do with it next year? Better safe than sorry, right?

As for your validation routines, the one that stands out as being insufficient is the email validation routine. Consider using something a bit more robust, like CGI::Untaint::email perhaps.

-sauoq
"My two cents aren't worth a dime.";