Some side notes, storing your passwords.txt in /tmp isn't wise, nor is having passwords in plain text. You use CGI then manually print headers. You don't set a session, so after you validate the login details you redirect to a URL which isn't ensuring the visitor is logged in. Make life easy on yourself, see CGI::Alternatives.