use HTML::Entities (); 
use CGI qw/:standard/; 
 
# get form data  
# sanitize params to avoid arbitrary code 
 
my $ok_chars = '0-9';  # limit param values to digits 
my @items = $cgi_object->param('id'); 
foreach my $i ( 0 .. $#items ) { 
    my $id = HTML::Entities::decode( $items[$i] ); 
    $id =~ s/[^$ok_chars]//go; 
    $items[$i] = $id; 
} 
 
# update database 
 
my $dbh = DBI->connect($connectionInfo,$user,$passwd); 
my $list = join("','", @items); 
my $sql = "insert into cart (id,cat_num)  
           select id,catalog_num  
           from tracks where id in ('$list')"; 
my $sth=$dbh->prepare($sql);  
$sth->execute();