Regarding your code, tachyon has said it, no need to repeat.

I suggest using CGI.pm, if you aren't already. That will solve your persistence problem, since re-invocations of the script automatically get the current cgi param=val pairs as hidden fields. The CGI pod calls these "sticky". You should treat this data as tainted.

After Compline,
Zaxo

Update: Reply to deryni, CGI.pm places all the current cgi data gathered in the next form written as hidden fields. I believe that only happens if the form action refers to the current script. 'man CGI' and search for 'sticky', 'hidden', and see the section on urls.