A modified version of your sample that does what I mean:

#!/usr/bin/perl -w
use strict;

use URI::Escape;
use HTML::Entities;
use CGI qw/:standard/;
use CGI::Carp 'fatalsToBrowser';

print header;

my $file;
if(param('test')){
        my $code = param('test');
        $code = uri_unescape($code);
        $code = encode_entities($code);
        open STDERR, '>&STDOUT';
        eval $code;
        print $@ if $@;
}
[download]

No need to create external, temporary files. There are some potential messy issues in there, but this is good enough for rough cut.