Thank you. I was not aware of url_param. That definitely helps.

However, after updating my code, I'm still seeing some strangeness (I'm probably missing something).

My user arrives at the form by following an email link. The link is basically:

my $forward_url = "$base_url/cgi-bin/login.cgi?uid=$uid&aflag=$aflag&s
+flag=$sflag";
[download]

When the user clicks on the link in their email, they are taken to login.cgi and the name-value pairs are grabbed by url_param. Thanks again. Now, the first time a user enters the page, the form is rendered blank by the template. I'm now sending thsi to the template:

if ($cgi -> url_param('first_launch') ne 'false') {
        
        my $requid = $cgi -> url_param('uid');
        my $aflag = $cgi -> url_param('aflag');
        my $sflag = $cgi -> url_param('sflag');
    
    my $vars = {
        base_url => $base_url,
        requid => $uid,
        aflag => $aflag,
        sflag => $sflag,
    };
    
    my $template = 'login.tt';
    print $cgi -> header;
    $tt -> process($template, $vars) || die $tt -> error();
    exit;
};
[download]

And here is the template:

<tr class="row_config_white">
        <td colspan="2" align="center" height="200">
                <form name="login_form" method="post" action="[% base_
+url %]/cgi-bin/login_fastapprove.cgi?first_launch=false"><br>
                        <h2>Windows into Waukesha Login - FASTapprove!
+</h2><br>
                        <font color="red">[% error_message %]</font><b
+r><br>
                        Email Address:&nbsp;<input type="text" name="e
+mail" size="30" value="[% email %]"><br><br><br>
                        Password:&nbsp;<input type="password" name="pa
+ssword" size="20"><br><br><br>
                        <!--<input type="hidden" name="first_launch" v
+alue="false">-->
                        <input type="hidden" name="requid" value="[% r
+equid %]">
                        <input type="hidden" name="aflag" value="[% af
+lag %]">
                        <input type="hidden" name="sflag" value="[% sf
+lag %]">
                        <input type="submit" value="Login"><br><br><br
+>
                </form>
        </td>
</tr>
<tr class="row_config_white">
        <td colspan="2" align="center" height="20">
                requid = [% requid %], aflag = [% aflag %], sflag = [%
+ sflag %], first_launch = [% first_launch %]<br>
                <a href="[% base_url %]/cgi-bin/forgot_pw.cgi">Forgot 
+Password</a>&nbsp;&nbsp;&nbsp;|&nbsp;&nbsp;&nbsp;<a href="[% base_url
+ %]/cgi-bin/request_account.cgi">Create New User account</a>
        </td>
</tr>
[download]

I'm using first_launch to keep track of state. Obviously, the user should only visit the empty form once. Notice that I've commented out the hidden input for first_launch above. I moved first_launch to the query string and set it equal to false. This works fine.

No matter what I do, however, I'm unable to pass first_launch as hidden. If I pass it as hidden, and change the script in the CGI from url_param to param, it isn't recognized. All of the other hidden parameters now work fine.

Why can't I pass first_launch the same way (as hidden)??? I am perplexed. I'd rather not have it in the query string.

Again, thank you so much!