But CGI is probably safe as a global, because there's no reason to have two of them in your program.

I absolutely agree with the general comment about some globals being ok if the coder knows what they are doing - but we are talking about mod_perl here, better to play it safe, and lexicals are arguably safer* in this case.

* Update: "safer" not in the sense of security, but in less chances for things to go wrong.