You shouldn't do what you're trying to do. Using variable substitution like that is slow, it's ugly, and it could be actively dangereous.

What you should do instead is use the param method of CGI - like this:

$input=new CGI;
print param('custtype')." ".param($xx);
[download]