For the reasons given by others, the implementation is correct. If you want, you could use:

my $vars = CGI->Vars;
[download]

(and then, if you want selected parameters, use $vars->{'first'}, etc.) which has a different icky way of dealing with multi-valued parameters.

The correct param() invocation would be:

    {
        first  => scalar $q->param('first'),
        second => scalar $q->param('second'),
    }
[download]