Wow. I am baffled by how many of the above examples actually embed the html in the CGI and try and interpolate the values directly into the html. This is only marginally less offensive as interpolating variables into SQL (not using placeholders).

Use either CGI::Ex::Fill or HTML::FillInForm to get your values into the form.

I'll leave it to you whether you generate your form dynamically, or if you use a static generated form, or a hybrid dynamic/static form created using a template system (you are using a templating system right?). The fill methods allow for generating the form however and then getting the values into the right places.

use CGI;
use CGI::Ex::Fill qw(fill);

my $q = CGI->new;
my %default = (
    foo => 'FooFoo',
    bar => 'BarBar',
    baz => 'BazBaz',
);

foreach my $k (keys %default) {
    $q->param($k, $default{$k})
        if ! defined $q->param($k);
}

my $html = '
<form>
<input type="text" name="foo">
<textarea name="bar"></textarea>
<select name="baz">
<option>Bing</option>
<option>BazBaz</option>
<option>Bang</option>
</form>
';

fill({text => \$html, form => $q});

print $html;
[download]

Which would print the following:

<form>
<input type="text" name="foo" value="FooFoo">
<textarea name="bar">BarBar</textarea>
<select name="baz">
<option>Bing</option>
<option selected="selected">BazBaz</option>
<option>Bang</option>
</form>
[download]