You really should do inserts based on the fields as they exist in the database, not the fields submitted by the form. Either hardcode the field names for the table, or to do it dynamically, use $sth->{NAME} to get a list of the field names for each table. If you use CGI's Var method, you can have a hash of the params and only insert if the key to the hash matches a table field name. You may run into issues of case so it's safest to turn everything to lower or upper with $sth->{NAME_lc} or $sth->{NAME_uc} and always name your form fields with that case.

I can't answer your question about how to handle multi-valued params without knowing the structure of your datbase table. Are the multiple values to be stored in multiple fields? They probably should be to keep your tables normalized, but it's hard to say without knowing what you are trying to do. If you really must have multiple values in a single field, then use join() or some other method of serializing the multiple fields into a single string.

If you aren't using DBI placeholders, I really, really recommend that you read up about them before implenting your script, you will need placeholders for CGI form values.