It looks like the last IF statement is the only one that executes and I can't figure out why.

Nope. All of the if-statements are executing, and since you are testing for numerical equivalence of two strings contain no numbers, they will all be satisfied too.

I have not read all that code, but a first requirement to make it work would be to use eq instead of ==. But good grief, there must be a better way to untaint that data ...

Update: Something along these lines, perhaps:

# Assuming a %statename hash has been set up:
if ($FORM{$state} =~ /^(\w\w)$/ and $statename{$FORM{$state}}) {
  $state = $1;
  $statename = $statename{$state};
}
[download]