my $secret_key = "BLAHBLAHBLAH"; my $session_cookie = $query->cookie('SessionID'); umask 0066; if($session_cookie) { my $mac; if(($sessionid, $mac) = split("-", $session_cookie)) { ###Ok, the user has returned a cookie, ###let's make sure it's not been tampered with. if($mac ne md5_hex($sessionid . md5_hex($sessionid.$secret_key))) { destroy_cookie($sessionid, "MODIFIED"); ###Ack. Nasty people return; } else { ###Other checks. }