More context would be needed than is given to be sure, but I'll hazard the supposition that $session was a CGI::Session or Apache::Session or similar object which automatically saves its data to a database during cleanup. Although writing directly to the underlying object rather than using the methods is a bit suspect.