In other words: The image is damaged on the way to the browser. Save the broken image in the browser, open the saved image in a TEXT editor, and look at what your code really sent to the browser.

Looking at your code, it seems the image is not sent to the browser at all. Instead, it is written to a file named output.png. Your code also does not send out any CGI headers. The code lacks all error checks, for the file operations (open, hint: autodie), and for DBI operations (hint: RaiseError => 1).

You should use the three-argument form of open, it has fewer surprises; and use a variable instead of a bareword. (Hint: open my $file,'>','output.png' or die "Can't open output.png: $!";.)

The CGI::Carp option warningsToBrowser inserts HTML data into the output at random locations, and it gives attackers unwanted insights into your code. Remove it from production code. The CGI::Carp option fatalsToBrowser appends CGI headers and HTML data to the output, even if you have already sent CGI headers and data. It also gives attackers unwanted insights into your code. Remove it from production code. Make sure that your code can't die after writing the first CGI header.

Alexander