A few basics:
- Use a config file. This database login stuff does not belong in your application code.
- Don't write your own HTML escaping code. Use CGI or HTML::Entities.
- Use templating to get the HTML out of your code.
- Use CGI::Application or something similar to get rid of that if/elsif tree for $action.
- Turn RaiseError on for DBI.
Also, if you want detailed responses, post less code. It would take hours to go through this code carefully.