You wouldn't use decode_entities - the data submitted by the browser is not HTML encoded. The only encoding going on is likely to be URL encoding which CGI.pm / Apache::Request / etc deal with automatically.