One: this doesn't work

why not? it looks fine as far as mason syntax goes, assuming you have such a variable.

two: I don't want people to be able to see $card_id in the url

sounds like you'll have to POST a <form> instead.

three: it's not pretty

HTML::Mason is a lot like sausage...