Eeek. For one, unless you really, really trust your users to type

  state = 'CA'
[download]

into the form, you're asking for trouble. Google for "SQL injection attack" or use super search here.

Far better is to do something like

  my $sql = "SELECT city FROM table WHERE state = ?";
  my $sth = $dbh->prepare($sql);
  $dbh->execute($FORM{state});
[download]

By doing this, the value will be quoted automagically as appropriate for MySQL, elimating the possibility that someone will type

  1; drop table database
[download]

into the form and have the results ruin your day.

Then you have to read the results before finishing the statement handle and disconnecting.

Also, since you're using CGI, it is completely unecessary to attempt to disect the query string yourself (and dissecting query strings by hand can be trickier than it first appears). CGI is quite good at handling that for you. You can drop that entire chunk of code that sets up %FORM, and instead do

  use CGI;

  my $cgi = CGI->new();
  ...
  my $sth = $dbh->prepare($sql);
  $sth->execute($cgi->param('state')) or die ...
[download]