Apart from what has been mentioned, you should be careful that your cgi's own security doesn't let people see its source. Start with

#!/usr/bin/perl -wT
use strict;
[download]

Then read up widely starting somewhere like the cgi/security links in Outside Links.