The hook needs to be called when the request is being parsed (i.e. in new), and the request needs to be parsed in order to know what parameters were supplied. .

Fortunately, the QUERY_STRING is parsed before the body is parsed, so you can use param to check parameters from the QUERY_STRING inside of your hook. Unforunately, the CGI request is not passed to the hook, so you'll have to store the CGI request in a "global":

my $cgi;

sub hook {
   return if not $cgi->param(...);
   my (...) = @_;
   ...
}

$cgi = CGI->new(\&hook);
[download]