I am well aware that rolling your own templating system is one of the rites of passage for almost every Perl programmer, but take a look at the already existing templating systems. Two of them (HTML::Template) and Petal) automatically encode attributes correctly, for the "other big two" (Template Toolkit and HTML::Mason) I'm quite sure that it is the same, but I haven't used them.

Other than that, the HTML::Entities module is what you need, like tinita already showed.