There is probably no general solution to the problem but each application requires another way of doing the testing. For example, in your serialization example, you could do sorting on the outcome:

$result = join '&', sort split '&', $result;
[download]

just for your testing. This seeems to be simple enough that no new bugs are introduced and will not require a sort in your production code.

While de-serialization could be a solution as well, one has to be very careful as it adds additional complexity. For example, if your serialization function returns "a=b&c=d&a=b" because of some bug, it could easily be "fixed" by a de-serialization procedure:

my %hash = map { split '=', $_ } split '&', $result;
[download]

Clearly, there are ways around this, like testing for the length of the string as well. But one has to spend extra time for each application and additional complexity can not be avoided.