1) Always check for success of your match-operators:

my ($u_firstname, $u_lastname) = ("Bogus", "Bogus");

if (param('firstname') =~ /^([a-zA-Z]+)$/) {
         $u_firstname = $1;
} else {
    # handle bogus case
}

if (param('lastname') =~ /^([a-zA-Z]+)$/) {
         $u_lastname = $1;
} else {
    # handle bogus case
}
[download]

2: do you redirect, or do you use internal requests? in both cases appending the parameters that need to be passed on to the query-string of the url you redirect to/process internally should work; if you do internal requests, use LWP::UserAgent and POST the requests with the needed parameters added according to the respective documenation.