Empty Session Creating on every Refresh - perl

Question

Every time I refresh my page an empty session gets created.
Index.cgi
#!perl.exe
use strict;
use warnings;
use DBI;
use CGI;
use database;
use Digest::MD5 qw(md5 md5_hex md5_base64);
use Data::Dumper;
use CGI::Session;
my $q = new CGI;
my $session = new CGI::Session();
my $db=database->new();
print $q->header;
$session = CGI::Session->load();
my $first_name = $session->param("userid");
my $login_fail=$q->param("attempt");
<div class='login_form' style=''>
<form method='post' action='Session.cgi'>
<table>
END_HTML
if ($session->is_empty)
{
print <<END_HTML;
<tr class='l_form_input'>
<td><input type='text' name='userid' placeholder='Email or Phone'/></td>
<td><input type='password' name='password' placeholder='Password'/></td>
<td><input type='submit' name='submit' value='Log In'/></td>
</tr>
<tr>
<td><span><a href='reg.cgi'>Not A Member Yet?</a></span></td>
<td><span><a href='forgot.cgi'>Forget your password?</a></span></td>
</tr>
END_HTML
if (defined($login_fail)) {
print "<tr><td colspan='2'>Incorrect Login<td></tr>";
}
}else {
print <<END_HTML;
<tr class='l_form_input'>
<td><span>Logged in as $first_name</span></td>
<td><span><a href='logout.cgi'>logout<span></a></td>
</tr>
END_HTML
}
print <<END_HTML;
</table>
</form>
</div>
Session.cgi
#!perl.exe
use strict;
use warnings;
use database;
use DBI;
use CGI;
use Digest::MD5 qw(md5 md5_hex md5_base64);
my $q = new CGI;
my $db=database->new();
#print $q->header;
my $email=$q->param("userid");
my $password=$q->param("password");
$password = md5_hex($password);
my $flag=$db->login_flag($email,$password);
if($flag == 1) {
require CGI::Session;
my $session = CGI::Session->new();
print $session->header();
$session->param("userid", $email);
$session->flush();
print "<META HTTP-EQUIV=refresh CONTENT=\"1;URL='http://localhost/website/index.cgi\">\n";
} else {
print $q->header;
print "<META HTTP-EQUIV=refresh CONTENT=\"1;URL='http://localhost/website/index.cgi?attempt=login_fail\">\n";
}

Answer 1

Pass the CGI object when creating the new CGI::Session:
my $session = CGI::Session->new($q) or die CGI->Session->errstr;
Otherwise, you're just creating an anonymous session each time that is not dependent on the user's information.