You need to html-escape the $message in your HTML form. CGI.pm's form methods do this automatically, so in this case you can simply do

print $query->hidden('message');
[download]

to generate the hidden field.

Otherwise, you can use

$escaped = $query->escapeHTML($message);
# ..
<input type="hidden" name="message" value="$escaped">
[download]

Or use Template:

<input type="hidden" name="message" value="[% $message | html %]">
[download]