If the action of the form is to post to the formmail.pl file, then the validation code will never have a chance to run. When a form is posted, it sends the information directly to the action page. you will not be able to use the security features on a form that posts to a pearl script.