CGI is a stateless environment. If you wish to maintain state across CGI requests, you'll need two things: Somewhere to store session data, and some way to securely identify which session belongs to who.

CGI::Session can help with this. I prefer working with the Mojolicious web framework, though, which makes session handling pretty simple.

I know it's terribly outdated, but CGI Programming with Perl (O'Reilly) does help to explain the nuts and bolts that one isn't fully exposed to when using a more modern framework. Pick up a used copy (one penny, plus shipping on Amazon, for example). 2nd edition is better than 1st, but both are over a decade old. Nevertheless, understanding the mechanics is still relevant even if you're moving beyond bare CGI into modern frameworks sitting on top of Plack.

Update: With respect to Mojolicious, be sure to take the advice of the tutorials by starting with a Mojolicious::Lite app. Most of the time that's adequate. You can start with the templates embedded directly in the app, and later explode them out to their own separate files. In my experience you don't really need a full Mojolicious app (with router and controllers separated) until the application grows large.