You should probably test all scalars (both $action and $ENV{HTTP_REFERER}, in this case) for defined-ness before doing string tests on them.

However, 'Use of uninitialized value' is not an error, it's a warning. You should probably also ensure that http headers are being issued by your program before any other output, so that warning messages such as this don't cause CGI/HTTP errors.