title: Correct using of CGI::Session, Perl
body: <p>I need to protect all pages on my site by login and password. I have one entry point, so it wouldn't be so hard. It is working now at the moment, but I want to improve authorization system (yes it works, but I want it would work correctly).</p>
  
  <p>Code which check login and password is so:</p>
  
  <pre><code>my $sth = $dbh-&gt;prepare(qq{select count(*) from admin where login = '$input_login' and password = '$input_password_hash'});
  $sth-&gt;execute();
  ($count) = $sth-&gt;fetchrow_array();
  $sth-&gt;finish();
  if ($count eq 1) 
  {
      $session-&gt;param("user_logged_in", 'true');
      print '&lt;META http-equiv="refresh" content="0;URL=/"&gt;';
  }
  </code></pre>
  
  <p>2 questions about it:
  1) Is it correct at all? 
  2) Script behaviour for end-user is so: user writing his login and password, form is sending, login page is loading again and after this (redirect to login page with blank fields and showing it for 1 second) protected data is appearing. How to remove showing login blank form and just login immediately? Inputting login and password, sending form, and data is showing  immediately, not after showing blank login for 1 second. I think it is about meta redirect. What do you think?<br>It is first 2 question.</p>
  
  <blockquote>
    <p>When a user clicks another link or re-visits the site after a short while should we be creating a new session again? Absolutely not.</p>
  </blockquote>
  
  <p>Quote from documentation of <code>CGI::Session</code> <a href="http://search.cpan.org/~sherzodr/CGI-Session-3.95/Session/Tutorial.pm" rel="nofollow">CGI::Session Tutorial</a>. </p>
  
  <p>It says, that I should firstly check if user session is exist and if not, new session would be created. Code should be so:</p>
  
  <pre><code>$cgi = new CGI;
  $sid = $cgi-&gt;cookie("CGISESSID") || undef;
  $session = new CGI::Session(undef, $sid, {Directory=&gt;'../tmp'});
  </code></pre>
  
  <p>But for me this code is working fine too (I can get access to session variables):</p>
  
  <pre><code>$session = new CGI::Session(undef, undef, {Directory=&gt;'../tmp'});
  </code></pre>
  
  <p>3) Can you explain me why this code works? First code works too. But 2nd code (without $sid as 2nd parameter) have not to work (but it works).</p>
  
  <p>Quesiton about accessing data from session:</p>
  
  <pre><code>$authorised = $session-&gt;param("user_logged_in");
  </code></pre>
  
  <p>4) Is it correct to access session variables this way? <br>
  5) What if I need access to <code>$session</code> on other script? How should I get access to <code>$session</code>?</p>