At some point - either before you store it, or when you retrieve it, run it through escapeHTML in CGI.pm

#!/usr/bin/perl
use strict;
use warnings;
use CGI;

my $q = CGI->new();

my $flaky_input = $q->param('some_textfield');

my $safe_to_output = $q->escapeHTML($flaky_input);
[download]

cLive ;-)