Daddio's right. I usually make my scripts (CGI or not) write its stuff to /tmp, and then have a separate script pick the files from there, validate them, and put them in the correct place (or mail, etc).