Is this code complete? It seems foggy as to where certain things are getting set... but one thing I notice is in gethtml() is that you open a file "$url" if $input{'target'} is the same as $token... but $url doesn't get set if $input{'target'} ne $token, which will show a blank page if it can't find a match.

I also noticed that you're parsing the header manually for data. Have you looked into using the CGI module to handle your post/get and cookie data? It's a definite plus to know how to parse the header manually, but CGI might make life a little easier.

~heroin_bob

(EDITED) Looks like matija covered my concerns while I was typing... :)