use strict;
use warnings;

my $str = q{<tag refid="5,8,7,3,2,1">};

sub sort_and_reformat {
    my $s = shift;
    return join " ", sort split m/,/, $s;
}

$str =~ s/"([^"]*)"/'"' . sort_and_reformat($1) . '"'/eg;
print $str, $/;
[download]

The regex isn't very selective about what it considers an attribute, so you might want to tweak that.

Update: You can use look-ahead and -behind to get rid of that ugly substitution body:

$str =~ s/(?<=")([^"]*)(?=")/sort_and_reformat($1)/eg;
[download]

If you want to be more specific about what to match, you can use something like this:

$str =~ s/(?<=<tag refid=")([^"]*)(?=")/sort_and_reformat($1)/eg;
[download]