in reply to Cleaning up CGI input Data

Here it is once again... the Canonical de-CGI Regex (tm):
$data =~ y/+/ /; $data =~ s/%[0-9a-f]{2}/pack('C', $1)/egi;