I don't like that you are looking at both $ENV{QUERY_STRING} and param. If this is a GET, then QUERY_STRING is gonna be ugly, not just the old_email. If this is a POST, then QUERY_STRING will be empty on compliant browsers, and it all shows up in params.