1) The $FORM variable is a hash which is defined (in your example, should have been defined) before LINE 3 as my %FORM;
2) The tr// operator (i.e. the transliteration operator) is used to search and replace characters
quoting from Perldoc :

tr/SEARCHLIST/REPLACEMENTLIST/cds
y/SEARCHLIST/REPLACEMENTLIST/cds

    Transliterates all occurrences of the characters found in the sear
+ch list with the corresponding character in the replacement list. It 
+returns the number of characters replaced or deleted. If no string is
+ specified via the =~ or !~ operator, the $_ string is transliterated
+. (The string specified with =~ must be a scalar variable, an array e
+lement, a hash element, or an assignment to one of those, i.e., an lv
+alue.)

    A character range may be specified with a hyphen, so tr/A-J/0-9/ d
+oes the same replacement as tr/ACEGIBDFHJ/0246813579/. For sed devote
+es, y is provided as a synonym for tr. If the SEARCHLIST is delimited
+ by bracketing quotes, the REPLACEMENTLIST has its own pair of quotes
+, which may or may not be bracketing quotes, e.g., tr[A-Z][a-z] or tr
+(+\-*/)/ABCD/.

    Note that tr does not do regular expression character classes such
+ as \d or [:lower:]. The <tr> operator is not equivalent to the tr(1)
+ utility. If you want to map strings between lower/upper cases, see p
+erlfunc/lc and perlfunc/uc, and in general consider using the s opera
+tor if you need regular expressions.

    Note also that the whole range idea is rather unportable between c
+haracter sets--and even within character sets they may cause results 
+you probably didn't expect. A sound principle is to use only ranges t
+hat begin from and end at either alphabets of equal case (a-e, A-E), 
+or digits (0-4). Anything else is unsafe. If in doubt, spell out the 
+character sets in full.

    Options:

c    Complement the SEARCHLIST.
    d    Delete found but unreplaced characters.
    s    Squash duplicate replaced characters.
[download]

Line 5 replaces all "+" characters, which in a URL-encoded string, mean spaces.
Line 6 decodes all URL-encoded data to character strings.
The rest of the lines remove all HTML tag-characters , if present.
and finally, the name=>value pair is assigned as a key-value pair to the $FORM hash, so that the rest of the script can refer to the data has $FORM{key}