You have to save your data somewhere. Variables only contain the information for the current invokation of the program, and a CGI script gets invoked once per request. So what you see is entirely expected behaviour.

For a simple solution you may want to look into DBM files tied to hashes as the DB_File module and others provide.

Makeshifts last the longest.