in reply to Perl Param

You really ought to escape the contents of whatever you pull out of the database and put into these attributes. By lack of quotes, you already experienced one way it can go wrong. But what if the database field contains a quote? Or an ampersand? As a contrived example, set 
$name = 'buy&trade&copy&paste" style="color:red';

print qq(<html><form>\n);
print qq(<input name="oops" value="$name">$name\n);
print qq(<br><input type="submit"></form></html>\n);

[download]
and display the result in a browser. Oops.

I gave one piece of code that solves this problem in a post from yesterday, Re: converting utf-8 to ISO-8859-1. If you don't have the UTF-8 problem, and I bet you don't, replace the first line in sub escape, the statement with pack, with a plain and simple 

        my $s = shift;

[download]

In Section Seekers of Perl Wisdom