&setcookie('sessionid',$user{'sessionid'},0,'.global-market.ch','/'); 

sub setcookie { 
    my($ky,$vl,$expires,$domain,$path) = @_; 
    my @days = ("Sun","Mon","Tue","Wed","Thu","Fri","Sat"); 
    my @months = ("Jan","Feb","Mar","Apr","May","Jun","Jul","Aug","Sep","Oct","Nov","Dec"); 

    $expires=1800000000 if (! defined $expires); #15.1.2027 
    $expires=1800000000 if ($expires<0); 
    $domain = $ENV{'SERVER_NAME'} if (! defined $domain); 
    $path = "/" if (! defined $path); 

    if ($expires==0) { 
        $expires=''; 
    } else { 
        my($seconds,$min,$hour,$mday,$mon,$year,$wday) = gmtime($expires); 
        $seconds = "0" . $seconds if ($seconds < 10); 
        $min = "0" . $min if ($min < 10); 
        $hour = "0" . $hour if ($hour < 10); 
        $year += 1900; 
        $expires = "expires=$days[$wday], $mday-$months[$mon]-$year $hour:$min:$seconds GMT; "; 
    } 

    $vl =~ s/ /+/g; 
    print "Set-Cookie: $ky=$vl; $expires path=$path; domain=$domain;\n"; 
} 

sub checksession { 
    my %cookie=(); 
    foreach (split(/; /, $ENV{'HTTP_COOKIE'})) { 
        $_=~s/\+/ /g; 
        my ($chip, $val) = split(/=/,$_,2); 
        $chip =~ s/%([A-Fa-f0-9]{2})/pack('c',hex($1))/ge; 
        $val =~ s/%([A-Fa-f0-9]{2})/pack('c',hex($1))/ge; 
        $cookie{$chip} = $val; 
    } 

    my $sessionid=''; 
    $sessionid=$cookie{'sessionid'} if (exists $cookie{'sessionid'}); 
    if ($sessionid ne '') { 
        $sth=$db->prepare("SELECT * FROM user,access WHERE sessionid=\"$sessionid\" AND user.rubrik=access.rubrik AND stat=1"); 
        $sth->execute; 
        if ($rw=$sth->fetchrow_hashref) { 
            %user=%$rw; 
            $sth->finish; 
            return; 
        } 
        $sth->finish; 
    } 
    $sth=$db->prepare("SELECT * FROM user,access WHERE username=\"\" AND user.rubrik=access.rubrik AND stat=1"); 
    $sth->execute; 
    if ($rw=$sth->fetchrow_hashref) { 
        %user=%$rw; 
    } else { 
        %user=('username'=>''); 
    } 
    $sth->finish; 
}

$sessionId = '"'; # fehler
$sessionId = 'irgendwas" or irgendwas LIKE "%'; # eventuell sicherheit

use CGI;
my $cgi = CGI->new();

....
my $cookie = setcookie($cgi, derganzerest)
print $cgi->header(
  -cookie => $cookie,
  -type   => 'text/html', # ersetzt print "Content-type: text/html\n\n"
);


sub setcookie {
  my ($cgi, $ky, $vl, $expires, $domain, $path) = @_;

  my $cookie = $cgi->cookie(
    -name => $ky, 
    -value => $vl,  
    -expires => $expires || '-1h',
    -domain => $domain,
    -path => $path
  );
  return $cookie;
}

use CGI;
use DBI;
my $cgi = CGI->new();
my $db = DBI->connect(....) or die $DBI::errstr;
....

&checksession($cgi, $db);

sub checksession {
  my ($cgi, $db) = @_;
  my $sessionId = $cgi->cookie('sessionid');
  if ($sessionId) {
    my $sessionIdSecure = $db->quote($sessionId);
    my $statement = qq~SELECT * FROM user, access WHERE sesionId = $sessionIdSecure AND ....~;
    my $sth = $db->prepare($statement);
    unless ($sth) { # fehlerabfrage
      die "Error in preparing statement: ", $db->errstr;
    }
    unless ($sth->execute) {
      die "Error in executing statement: ", $db->errstr;
    }
# ..... usw.


} # checksesssion

#!/usr/bin/perl -w
use strict;
use CGI::Carp qw(fatalsToBrowser);

print "Content-type: text/html\n\n";

my $unique = $ENV{'UNIQUE_ID'};

print "Unique: $unique";