use CGI.pm

my $q = new CGI;

my $xml = CGI::unescape($q->param('xml'));