I think you should take a look at using CGI, hand crafting HTML like this is far too error prone.

# use warnings and use strict are assumed...
use CGI;
my $q = CGI->new;

while(my @options=$sth->fetchrow_array()){
  print $q->popup_menu( -name => 'whatever',
                        -values => \@options,
                        -default => $selected,
                       );
}
[download]

is much less error prone, and will produce correctly quoted HTML without you having to think about it.

jdtoronto

PS: All code is untested, see the module documentation.