title: "CGI::param called in list context" warning in Perl
body: <p>I have a perl script that adds data in database</p>
  <pre><code>#!/usr/bin/perl
  use cPanelUserConfig;
  
  use strict;
  use warnings;
  use DBI;
  use CGI::Carp qw(warningsToBrowser fatalsToBrowser);
  use CGI;
  use CGI::Cookie;
  use CGI::Session qw();
  use JSON;
  #use MIME::Lite;
  
  my $CFG = do &quot;config.pl&quot;;
  my $cgi = CGI-&gt;new;
  my $db_handle = DBI-&gt;connect (&quot;DBI:mysql:$CFG-&gt;{database}&quot;, $CFG-&gt;{user}, $CFG-&gt;{password} ) or die &quot;Couldn't connect to database: $DBI::errstr\n&quot;;
  
  my $decdata = decode_json($cgi-&gt;param('POSTDATA'));
  
  my $CustomerID;# = $decdata-&gt;{'CustomerID'};
  my $DeliverySlot = $decdata-&gt;{'DeliverySlot'};
  my $PaymentMode = $decdata-&gt;{'PaymentMode'};
  my $CustomerName = $decdata-&gt;{'CustomerName'};
  my $Address = $decdata-&gt;{'Address'};
  my $City = $decdata-&gt;{'City'};
  my $Mobile = $decdata-&gt;{'Mobile'};
  
  my $th = $db_handle-&gt;prepare(&quot;select customer_id from table_customers where mobile = '$Mobile'&quot;);
  $th-&gt;execute() or die &quot;Couldn't connect to database: $DBI::errstr\n&quot;;
  my @data = $th-&gt;fetchrow_array();
  if ($data[0]) 
  {
      $CustomerID = $data[0];
  }
  else
  {
      my $sql_query = qq{insert into table_customers values (NULL, '$CustomerName', '$Address', '$Mobile', NULL, NULL)};
      my $statement = $db_handle-&gt;prepare ($sql_query)    or die &quot;Couldn't prepare query '$sql_query': $DBI::errstr\n&quot;;  
      $statement-&gt;execute()   or die &quot;SQL Error: $DBI::errstr\n&quot;;  
      $CustomerID = $statement-&gt;{mysql_insertid};
  }
  
  my $sql_query = qq{insert into table_orders values (NULL, '$CustomerID', NOW(),  '$PaymentMode', CURDATE(), '$DeliverySlot')};
  my $statement = $db_handle-&gt;prepare ($sql_query)    or die &quot;Couldn't prepare query '$sql_query': $DBI::errstr\n&quot;;  
  $statement-&gt;execute()   or die &quot;SQL Error: $DBI::errstr\n&quot;;  
  
  
  my $id = $statement-&gt;{mysql_insertid};
  my $sql_query = qq{insert into table_order_status values ($id, 1, NOW())};
  my $statement = $db_handle-&gt;prepare ($sql_query)    or die &quot;Couldn't prepare query '$sql_query': $DBI::errstr\n&quot;;  
  $statement-&gt;execute()   or die &quot;SQL Error: $DBI::errstr\n&quot;;  
  
  
  my $aref = $decdata-&gt;{'ItemList'};
  
  for my $element (@$aref)
  {
      my $i_name = $element-&gt;{ItemName}; 
      my $i_quantity = $element-&gt;{Quantity}; 
      my $i_mrpprice = $element-&gt;{MRP}; 
      my $i_sellprice = $element-&gt;{SellPrice};
          
      my $sql_query = qq{insert into table_order_details values ('$id', 2, 2, $i_quantity, '$i_mrpprice', '$i_sellprice', '$i_name')};
      my $statement = $db_handle-&gt;prepare ($sql_query)    or die &quot;Couldn't prepare query '$sql_query': $DBI::errstr\n&quot;;  
      $statement-&gt;execute()   or die &quot;SQL Error: $DBI::errstr\n&quot;;  
  }
  
  
  $db_handle-&gt;disconnect;
    
  print $cgi-&gt;header;
  </code></pre>
  <p>While executing the script i am seeing this error in error log file, though entry is perfect in DB.</p>
  <pre><code>[Fri Sep 25 06:57:59.276603 2015] [cgi:error] [pid 530749:tid 140571387594496] [client 61.0.172.200:16058] AH01215: [Fri Sep 25 06:57:59 2015] PlaceOrder.pl: CGI::param called in list context from PlaceOrder.pl line 19, this can lead to vulnerabilities. See the warning in &quot;Fetching the value or values of a single named parameter&quot; 
  </code></pre>
  <p>Line 19 is:</p>
  <pre><code>my $decdata = decode_json($cgi-&gt;param('POSTDATA'));
  </code></pre>
  <p>What is this error and how to fix this. Any help or comments will be highly helpful.</p>