I thought I'm all settled with following code: 
sub form {
    my $self = shift;
    my %params = @_;
    
    # I could use delete right?
    my $skip = array_to_hash($params{'skip_fields'}); # Array/ArrayRef
    
    my $q = $self->query();
    my %vars = $q->Vars();
    
    use HTML::Entities;
    foreach(keys %vars){
        next if $skip->{$_}; # Don't encode if it's in skip list 
        
        $vars{$_} = HTML::Entities::encode($vars{$_});
    }
    
    return \%vars;
}

[download]
But here is a problem. I use UTF-8 so that site would support Serbian (latin not cyrilic) so I end up with funky entities instead of letters like Š, Đ, Č, Ć and Ž.

Which when I hit preview I realised this site is doing too :)

Is there any other way to filter the input that would not do this? I dont want Š instead of Š in my forms ...

I believe it's ok to have those chars not encoded since I set both header and meta charset to utf-8.

Have you tried freelancing? Check out Scriptlance - I work there. For more info about Scriptlance and freelancing in general check out my home node.

In reply to Preventing XSS by techcode

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.