I would add a third - you are not correctly untainting user input. Specifically:

open (BOBIN, ">>$datefile") ...
[download]

is not a good idea when 'datefile' is extracted from a form field, since this gives users the ability to write to any file on your file system via the classic backwards directory traversal trick (e.g. what if the input was "..\..\etc\passwd" ?). Whether or not the field is "hidden" is irrelevant.

Equally, echoing user input on your confirmation page verbatim leaves you open to Cross Site Scripting attacks (e.g. what if the input contained <script> ... </script> tags?).

A recent cautionary tale along these lines can be found here.