If you are on an Apache-server, there are a lot of Session-modules on CPAN such as Apache::Session. They may or may not use cookies in maintaining state, but I learned never to rely on cookies to do that: some users (either deliberately, out of misguided fear or because of company policy) cannot or will not accept cookies and then your whole session management breaks down.
CountZero
"If you have four groups working on a compiler, you'll get a 4-pass compiler." - Conway's Law