Yes, that's definitely an issue. One easy fix is to keep track of the cart_id with cookies and remove it from the url.

Lincoln Stein's CGI.pm, which is part of the regular perl distribution, has excellent support for cookies. Read the manual.

I place the following code in web_store.cgi after picking up the value of the cart_id from the form_data array:

                $cart_id = $form_data{'cart_id'};

                unless ($jimbo eq "sam")
                        {
                        use CGI;

                        $query = new CGI;

                        $cookie = $query->cookie('cart_id');

                        $cart_id = $cookie;
                        }

This reads the cookie for the cart_id. (N.B.: There is no variable called "jimbo" and it never equals "sam" - I just do this to contain the call to cgi.pm).

Then we need to set the cookie in the first place. I do that right after the call to these subs:

                  &delete_old_carts;
                  &assign_a_unique_shopping_cart_id;
                  &increment_visitor_counter;

Here's the code:

                if ($cart_id eq "")
                  {
                  &delete_old_carts;
                  &assign_a_unique_shopping_cart_id;
                  &increment_visitor_counter;

                  use CGI;

                  $query = new CGI;

                  $cookie = $query->cookie(-name=>'cart_id',     
-value=>"$cart_id",
                -expires=>'+1d');

                  print $query->header(-cookie=>$cookie);

                  $cookie = $query->cookie('cart_id');

                  $cart_id = $cookie;
                  }

By the way, you may have to remove 1 newline (only) from the http header at the top of the script to get this to work - you'll know if you do if it tries to print the content of the cookie to browser.