in reply to CGI and security

Two of the most immediately useful tools you can use to troubleshoot this sort of thing are:   on the client side, a debugger such as Firefox; and on the server side, the Apache logs.   You need to conclusively see what the client is actually sending, and then to see what the server recorded in its own logs.   (What it sends back to the client is probably not very useful for this purpose.   You won’t get far, just looking at that.)

Any of us could rattle off a “rogue’s gallery” of likely suspects, particularly in the case of file uploads, but the list is long enough that speculation won’t help much.   You need facts.