Well, the user agent is free to replace a '@' with %40. It's your code that has to cope with it. And since you're doing all the work yourself, you'll have to fix it yourself.

Why on earth are you handrolling all this parsing yourself? You aren't doing it correctly (otherwise, you wouldn't ask the question you're asking), and there are modules that do it better. One of them even comes with perl. It's called "CGI".