I agree with gjb and other reply'ers - I also prefer to use CGI.pm to read "param"s. You can only read cgi parameters once :-)
Again, agreed. If you *have* to use user supplied data as variable names, then turn on "taint" mode - in fact,
- it is very strict about what it will allow your cgi scripts to do. It will only allow you to do things that are safe, and it forces you to "untaint" data coming in to your script from outside - like all environment variables and all user supplied data.
HTH.