Excellent points by jeffa and jdtoronto that will be helpful in my own work. Two additional points:

1. True, Javascript is not to be trusted, and I always validate in my Perl script (as a function of untainting input). However, I still occassionally use JS to validate on the client side (if they have it turned on and aren't trying to crack it) as a preliminary filter because it's fast, no delay, no tapping of the server, no screen refresh. Double-coding? Yes. But it might make things more convenient for the average surfer. Just something to keep in mind.

2. If you are rolling your own confirmation page, and using H::T, consider the handy associate setting, which populates your template with the original data (I learned this from jeffa's helpful H::T tutorial):

my $query = new CGI;
my $name = $query->param('name');
my $address = $query->param('address');
my $city = $query->param('city');
my $zip = $query->param('zip');

my $template = HTML::Template->new(filename => 
        '../confirmation.tmpl',
        associate => $query,
        die_on_bad_params => 0);
[download]