Well, i highly recommend cookies, but since you can't, you can still use Apache::Session (which allows you to store state information in a database, a DB file, or a flat file) and use a hidden field to store the session id.

jeffa

L-LL-L--L-LL-L--L-LL-L--
-R--R-RR-R--R-RR-R--R-RR
F--F--F--F--F--F--F--F--
(the triplet paradiddle)