my $nick = $cgi->param('nick');
...
my $wpage = $cgi->param('wpage');

my $nick = encode_entities($nick, '<>&"');
...
my $wpage = encode_entities($wpage, '<>&"');