There is no need to re-invent the wheel here - there is a module called Apache::Session which implements most of the above methods.

It is an OO module with pluggable backends, and it can store things in files Apache::Session::File databases Apache::Session::MySQL and many more!

A very good reference on this is the mod_perl book Writing Apache Modules with Perl and C. This goes on in depth about all the above methods you suggest. It also talks about how to make sure the user keeps giving you back the session number - in a cookie, in a form or as part of the URL eg http://z.com/87665456789/page.cgi(easy to do with mod_perl hard otherwise)

merlyn implemented a novel approach to session storage by spawning a new webserver for each session on a new port. This has the advantage that you can store lots of data in variable form in memory. It needs careful management though. Look for it in his web column here.