What about putting them into a param, like this?

my $addbutton = button(-name=>'AddFlagNote',
    -value=>'Add Flag Note',
    -onclick=>"return addNote('FlagNotesTable', '')",
    -onsubmit=>print $cgi->hidden(-name=>'flagNotes',
                                  -default
           =>"return getAllNoteValues('FlagNotesTable')"));
[download]

Any reason why this approach wouldn't work?