Usually you use CGI::Session or similar and save the SessionID in the cookie.
There is no way to make a website 100% secure. I'am thing you allready use strict; use warnings;. For websites (or any other Application with userinput) I suggest you use taint-checking on user input and actually CHECK the input (eg Data::FormValidator).
Take care quoting everything which could escape a value in any layer (perl, DB (sql inquetion, DBI does this for you if you use placeholders), ...).
And of course use actual versions of httpd, perl and modules.

ciao

knoebi