He might as well use perl to create his hidden form field value using the same array as in the scrolling_list call.

For (de)serializing the stuff he can make good use of the code you++ provide on your scratchpad. ;-)

Thanks, but URI escaping is accessible in this case and works just fine. No need to introduce a new protocol.

With this data, my delimiter is going to be rediculous.

Thanks.

Having to pick a delimiter that won't occur in your data is bad. Instead, escape the data such any instance of you your delimiter is removed or distinguishable from an actual delimiter.

In this case, it's easy to remove commas by URI escaping the data before joining the fields.

At the client, (My syntax might be off)

list_items.value = list_items
                   .map(function (v) { return encodeURIComponent(v) })
                   .join(',');
[download]

At the server,

use URI::Escape qw( uri_unescape );

my @list_items = map { uri_unescape($_) }
                 split(/,/, $cgi->param('list_items'));
[download]

But javascript is not needed.

The following works for me, fully escaping all binary stuff in the value array, just using CGI (and URI::Escape for serialization as proposed by you)

#!perl
use strict;
use CGI;
use URI::Escape;
my $cgi = new CGI;
my $i = 0;
my @Values = map { uri_escape pack('c', $i++) } 1..10;
my %Labels = map {$_, "Label$_"} @Values;
my $size = @Values - 1;
my $attr = 'listbox';

my @rightParams = (
  -class=>'writeField',
  -name=>$attr,
  -values=>\@Values,
  -size=>$size,
  -multiple=>'true',
  -labels=>\%Labels,
);

my @selected = $cgi->param($attr);
my @all = $cgi->param('theValues');

print $cgi->header(),
  $cgi->start_html(-title=>$attr),
  $cgi->start_form(),
  $cgi->scrolling_list(@rightParams),
  $cgi->p('all (from hidden field): ', join(q(, ), @all)),
  $cgi->hidden(-name=>'theValues', -default=>\@Values),
  $cgi->p('you selected: ', join(q(, ), @selected)),
  $cgi->submit(),
  $cgi->end_form(),
  $cgi->end_html(),
  ;
[download]

Deserialize with uri_unescape as needed.