well, if you are using CGI.pm then why not use the textfield method? it escapes html for you (it uses the escapeHTML() method internally):

use CGI;
my $q = new CGI;
my $value = '<img src="/someimg.gif">';
print   $q->start_html(),
        $q->start_form(), 
        $q->textfield(  -name=>'test',
                    -value=>$value),              
    $q->end_form,
    $q->end_html;
[download]

it works great!