I do use server side sessions for a lot of things, but I don't use them all the time because sometimes I simply want to pass data between two forms, and I'm not passing sensitive data, and I'm not 'eval'ing it or using it to create file names, so I have minimal security concerns about the data being hijacked. Adding Apache::Session to the project would add a lot of complexity to the project (it's a lot more code that a bug could potentionally be in. As they say "code deleted (or not used) is code debugged").
For more complex projects, such as shopping cart systems, I do use server side sessions, but I usually roll my own using a SQL database, rather than adding in the complexity of Apache::Session. It's features of serialization and locking are already provided by the database, retreiving data is done easily through DBI's fetchrow_hashref, and I can insert data easily through CGI::SQL's &insert_from_param function. Furthermore, I'm not tied to having my session table named a particular thing, or having the columns named a particular way. | [reply] |