Perl ISAPI takes car of the content-type header for me. See the perl FAQ
http://docs.activestate.com/activeperl/5.10/faq/Windows/ActivePerl-Winfaq7.html#My_CGI_scripts_don_t_seem_to_run
As for you concern on the SQL query, no end user will have direct call access to this script, it will be called via SSI once fully working.