The hook needs to be called when the request is being parsed (i.e. in new), and the request needs to be parsed in order to know what parameters were supplied. .
Fortunately, the QUERY_STRING is parsed before the body is parsed, so you can use param to check parameters from the QUERY_STRING inside of your hook. Unforunately, the CGI request is not passed to the hook, so you'll have to store the CGI request in a "global":
my $cgi;
sub hook {
return if not $cgi->param(...);
my (...) = @_;
...
}
$cgi = CGI->new(\&hook);