1. Templates were not used. If they were, you would have been handed a bunch of template files and would not see many print statements. You will want to set up one template for every different page that exists. Templates allow you to separate the form (how it's displayed) from function (what is displayed). There's a lot you can do with this.
2. Don't use heredocs for CGI display. They're just glorified print statements, essentially. You will want to use them for your SQL statements. Something like

   my $sql = <<__END_SQL__;
   SELECT a.foo, b.bar
     FROM some_table a,
          some_other_table b
    WHERE a.id = b.id
      AND a.name = ?
   __END_SQL__
   [download]

   If you're wondering what the question mark is in that sql statement, look up placeholders in the DBI documentation. (Follow the link ...)

3. Test suites. There are oodles of books on the topic of testsuites, and testing in general. There are also dozens of threads at the monastery regarding them. The basics are this:
   • You have a function / script / webpage / whatever that has stuff it has to be able to do.
   • You want to verify that your thingy does what it's supposed to do. More importantly, you want to verify that it will return the appropriate error if it's given bad input. (Testing error cases is more important than testing success cases. Why this is true is left as an exercise for the reader.)
   • Look up Test, Test::Harness, Test::Cmd, Test::Cmd::Common, and the hundreds of other test suites that exist. For testing the CGI functionality, you're probably going to have to go to something like RationalRose or do it by hand. See if the testing group in your company has access to something like RationalRose or the like. Hand-testing forms is really annoying work.
   • Before you actually write your test-suite in Perl (or whatever), write it out on paper. List all the different types of input your thingy can possibly receive. Then (and this is the hard part) think about all the different types of bad input your thingy can possibly receive. For example, let's say you have a subroutine that updates the total of a foo. Your subroutine is given the name of the foo and the value. Are you making sure that the value is actually a number? (Look at Regexp::Common for help with that.) Are you making sure that the name is a valid name for a foo? Stuff can work and still have tons of bugs. (Look at Windows for an example of this.)

As always, feel free to post more questions, ideas, concerns, etc. Many of us (myself included) are more than willing to help you 1-on-1. Feel free to ask! :-)

------
We are the carpenters and bricklayers of the Information Age.

The idea is a little like C++ templates, except not quite so brain-meltingly complicated. -- TheDamian, Exegesis 6

Please remember that I'm crufty and crochety. All opinions are purely mine and all code is untested, unless otherwise specified.