Just thought of another problem: say I'm authenticating a user, I check for a cookie containing a session ID, if the cookie doesn't exist I check for login parameters from a form. If the login is valid, I want to set a cookie containing a session ID. I have all the preceeding in a subroutine which I call, then later I will print out an HTML document (say: a welcome message) - which is the best way to handle this? Should I send the cookie & header, let the script finish running then send the HTML (the actual data, not the header), or should I return the cookie to the calling code and send it only right before the HTML? Thanks.