in reply to Re: security issues with an index.pl-type thing...
in thread security issues with an index.pl-type thing...

Yes, it is passed as @ARGV for a CGI script such as that (that's probably run like CGI script, though the server might need configuration to do that). However, you are probably better off using the CGI module (or, maybe, a similar module) to parse it, because the string is not in an immediately usable format, and the CGI module knows how to extract the stuff you want. (Don't reinvent the wheel!)