Yay! After two nights of chatterbox discussion, a few lengthy posts, and installing cgi-lib.pl on my machine (*shudder*), I've figured out why your code isn't working as you intended. :)

It turns out that cgi-lib.pl handles multi-value params (as in ?sites=1&sites=2&sites=3) by joining the values with a null character, aka "\0" and "\c@". The value you're getting from $in{sites} is actually "1 \c@2 \c@3 ". (The spaces are from your form, and the null characters are from cgi-lib.pl.) When you split on whitespace, the first value is okay, but the other values have a hidden null character.

The solution (assuming that you want to continue using cgi-lib.pl, rather than switching to the CGI module), is to change VALUE="$modSiteNumber " to VALUE="$modSiteNumber" in your form generator, and create the array with @sites = split /\0/, $in{sites}; in your form parser.