koolade's suggestion echoes an approach that has worked well for me. Here's a bit of (slightly verbose) code to illustrate:

sub make_rand_str {
   my $num_chars = shift;
   my @possible_chr_array = @_;
   my $num_possibles = @possible_chr_array;
   my $rnd_str = "";
   for (my $i=$num_chars; $i--;) {
      $rnd_str .= $possible_chr_array[rand($num_possibles)];
   }
   return $rnd_str;
}

my $rnd_str = make_rand_str(4, "A".."Z", "0".."9");

my $url = "http://my/host/cgi/script.pl/$rnd_str",
[download]