Not sure I understand completely but it sounds like you could use sessions. The first CGI creates a session and includes the session ID in the form. The next CGI then checks the session and redirects to the begging if there is no session. you could also store a state value in the session itself so that the user can only access the correct script. Each script checks the state and redirects back to the begging or previous script if the state is not correct.