You made a good choice using the CGI module, and that well help a lot, but I'm concerned that you're not using the Taint, Strict, or Warnings pragmas. If you're worried about security in your code, you should be using those as a first step. Also, consider using the CGI module to parse the incoming parameters for you. That is one of the most valuable aspects of CGI, and it will increase the security of your program.
Other than that, nothing major jumps out at me. However, I'd want to make sure it runs under the pragmas I listed above before I let it go live.
