As I understand you want to make db related calls from your Controller. Why don't you encapsulate the DB calls in a separate perl module ? You could have this:
- YourApp::CGI::User - the controller
- YourApp::USer - the model class
Your controller would validate the data (via Data::FormValidator) and invoke methods in the model class to check the user/session in the db. The the db handler could reside in the model class.