I haven't used it, but from what I can see, CGI::Session looks very easy to use. It also has a Cookbook available with samples of frequently used recipes.

Cheers,
Ovid

New address of my CGI Course.
Silence is Evil (feel free to copy and distribute widely - note copyright text)

Set the cookie like:

use CGI;
my $q = new CGI;

sub set_cookie {
    my ( $username ) = @_;
    my $cookie = $q->cookie( -name => 'validated', 
                             -value => $username, 
                             -expires => '+1h', 
                           ); 
    print $q->header( -cookie=>$cookie );
}
[download]

This sets a cookie called 'validated' which contains the users name and expires in one hour. If you keep resetting it the 1 hour session contiunes until 1 hour of disuse.

Check the cookie like this:

# returns username stored in cookie if we have validated user or 0 if 
+not
sub validate {
    return $q->cookie('validated')  if $q->cookie('validated');
  return 0;
}
[download]

You don't really need to put the password in the cookie but a checksum is a good idea so it can't be spoofed. Consider how your site (won't) work if cookies are disabled. Another non cookie approach is to use 'hidden' fields and a checksum (like the one you need to put in your cookie)

use CGI;
use Crypt::Blowfish;
use Crypt::CBC;
my $q = new CGI;
my $c = new Crypt::CBC( 'gnuisnotunix','Blowfish');

my $hidden_fields = '';
if ( validate( $q->param('username'), $q->param('password') ) {
    my $hidden_fields = get_hidden_fields( $q->param('username');
    show_database_form($hidden_fields)
}
else {
    error( 'Invalid username/pass' );
}

sub validate {
    my ( $username, $password ) = @_;
  # validate using the user/pass
  return 1 if $username eq 'foo' and $password eq 'bar';
  # alternatively validate on the hidden fields
  return 1 if validate_checksum();
  return 0;
}

sub get_hidden_fields {
    my $username = shift;
    my $checksum = $c->encrypt_hex($username);
  return <<HTML;
<input type="hidden" name="username" value="$username">
<input type="hidden" name="checksum" value="$checksum">
HTML;
}

sub validate_checksum {
    return $c->decrypt_hex($q->param('checksum')) eq $q->param('userna
+me') ? 1 : 0;
}

sub show_database_form {
    my $hidden = shift;
  return <<HTML;
<form method="POST" action="$MY_CGI">
$hidden
blah blah
<input type="submit" value="Submit" name="Submit">
</form>
HTML
}
[download]

tachyon

s&&rsenoyhcatreve&&&s&n.+t&"$'$`$\"$\&"&ee&&y&srve&&d&&print