CGI form field generators fill in the current values of those fields (i.e. the values as they are in the param() method - normally the user input) if those values exist.

You can override those values by setting the param before creating the form fields:

$cgi->param("current","something else");
[download]

Also, you specify name/value pairs for hidden fields using either hidden($name,$value) or hidden(-name => $name, -value=>$value). Mixing them, as you're using for the user field does not work.

Also also, that code does not print anything, and if it does did it wouldn't print what you're claiming:

use CGI;
use strict;
use warnings;
my $cgi = CGI->new;
my @buffer;
my $timestamp = time;
my $user = "Me";

$cgi->param("current","something");  # set "current"

push(@buffer, $cgi->start_form(-method => 'post' , -action => 'example
+.cgi'),
           $cgi->submit(-name => 'edit_notes', -value=>$timestamp, -la
+bel =>"edit"),
           $cgi->hidden(-name => 'user', $user),
           $cgi->hidden(-name => 'current', -value=>'example'),
           $cgi->end_form);

print @buffer;
[download]

output:

<form method="post" action="example.cgi" enctype="multipart/form-data"
+>
<input type="submit" name="edit_notes" value="edit" /><input type="hid
+den" name="user" value="" me /><input type="hidden" name="current" va
+lue="something"  /></form>
[download]

Note the problem caused by the wrong arguments in hidden( -name => 'user', $user)