I'm not familiar with CGI::Session, but a quick look at the code shows that the first argument to save_param needs to be the $query object, and you're passing the return value from the call to $query->param, which will be a string, so that's probably why that code doesn't work.