You cannot know that it's opening the files correctly unless you check the return values of your open calls. It's entirely possible that the script opens the files properly when run via the command line (with your user permissions), and fails based on permissions when run by the webserver (who usually runs as 'nobody').

Use the ever-popular "or die "Couldn't open the file: $!";" construct after your opens to ensure things are hunky dory. See perlopentut for examples. Failing to check the return value of open is a very common mistake among beginners. It is, however, one of those absolutes in life: always always always check the return value of open. Even if you're sure the file will open, even if you don't care if it opens or not, check; develop the habit.

If the script dies once you check the return value of open, then you can at least check the server's error log to see what error is being reported.

It also might not hurt to print out all of the parameters captured by the CGI module, so that you can ensure that the params are what you think they are.