Gernerally speaking, you haven't addressed much of the problem in your question. You had better check the data coming in from the CGI or you could run into trouble very quickly. What problems specifically? Your DB will throw an error if you try to set a column that doesn't exist; if the data is too long your DB will puke, etc. You'll most likely want a slick module like CGI::Application::ValidateRM to help you validate input.

Also, In my code, I keep an array of valid fields name that make up my DB table and I only pass through params that match those.

You may also want to wrap your DB routines in an eval to catch the exceptions cleanly and return a friendly HTML page. Or you can:

use CGI::Carp qw(fatalsToBrowser );
[download]

Check out the tutorials here on PM.

Good luck.