in reply to security in forms

if you use mod_perl you could write a register_cleanup handler where you can commit or rollback user input.
register cleanup phase get called even if the user press the stop button during the upload of the form data.