I won't comment on Perl Vs PHP for handling sessions (since I've never written anything in Perl that uses sessions), but PHP does have insane default settings for its session handling. IIRC the developers won't change the defaults because they are terrified that browsers won't be able to handle HTML without any errors in it.