You might need to uri_escape() your username and password using URI::Escape before inserting them into your QUERY_STRING. However, the resulting characters might cause issues for your shell. I'm not sure what to do about that second part.
---
It's all fine and dandy until someone has to look at the code.
Comment on Re: blank string returned from piped command
the program i'm calling is url-escape aware, so it will work whether the string is escaped or not. and if i expected the username or password to contain anything unexpected, i could quote them:
my $com = 'env QUERY_STRING=username="'.$uname.'"\;password="'.$pwd.'"
+ /usr/bin/custom_auth_tool';