Always, yes always always, check the sucess of file open by adding

or die "Couldn't open '$upload_dir/$filename': $!"

update and print a content header before you print your thank you message, and make the top part look like this:

use CGI; use CGI::Carp qw(fatalsToBrowser);