where in ExecuteQuery is session given a value? I think this also shows you have not included use strict; use warnings; in your code either, tisk tisk !!

No tsk tsk

package manageusers;

use strict;
use diagnostics -verbose;
use warnings;
use CGI;
use CGI::Carp qw(fatalsToBrowser warningsToBrowser);
use CGI qw(:standard escapeHTML);
use CGI qw/:standard/;
use Data::Dumper;

use Digest::MD5 qw(md5_hex);
use CGI::Session;
use CGI::Cookie;
use Mail::Sendmail;
use Time::HiRes qw(usleep);
use Time::Local;
[download]

session is given a value when a user logs on. The user can do different things including changing password in the user table which is what this block of code is supposed to do..

Session is given a value here $session = OpenSession($dbh,$tsid);

Your use of globally scoped lexical variables has gotten you in trouble before too, when you dont know what you are doing it is a bad practice.

i suspect the flush belongs in OpenSession

Again i ask where in ExecuteQuery is session given a value?, Pay attention now, HOW DO YOU INSURE SESSION HAS A VALUE WHEN ExecuteQuery IS CALLED so you can use it to call the flush method?

It should be  my $session = OpenSession($dbh,$tsid); and my $session  = new CGI::Session("driver:MySQL", $sid, {Handle=>$dbh, LockHandle=>$dbh}); to insure session has a value when you use it rather than being possibly unitialized like it is at times now!