To work properly, session variables require that cookies be enabled on the client's browser. Many people have disabled cookies, usually after reading a Jesse Berst article where he evangelizes how cookies are the devil and judgment day is coming soon for all those who use them.
My initial gut reaction to the question is always as follows:
How many people out there are seriously afraid of cookies so much that they'll disable them entirely, yet trust your site enough to give you their credit card number online?
The discussion always goes further than that, of course. Sometimes the boss -- who always knows best -- just wants it that way. Sometimes the programmer doesn't understand the difference between asking someone to store temporary information on their machine and handing over their credit card information. Sometimes shopping carts are created and then, at checkout time, there is an option for the user to fax or phone in their credit card details to complete the transaction. And, of course, session variables are not used solely for shopping. <G>
In any case, there are times where session variables would come in handy even when cookies are disabled. Many sites have implemented a solution similar to what I'm about to describe.
You have a database table strictly for generating numbers to replace the usual session ID. Once a user has one of these session IDs, it is appended to URLs for links and forms.
Anything they do, and any items they add to their cart, are inserted into a separate table with the session ID alongside to identify them.
There are other ways to get around missing cookies, of course. This, IMHO, is the simplest to implement, and would require minimal changes to your existing architecture. You would use the database structure for retrieving session information and do away with the session variables altogether (unless you don't already get enough of the 'code two web sites for the price of one' dilemma with Netscape and IE).
There is a sample application now available online at
http://www.aspfaq.com/cart/ - you can play with the cart and download the sample code.
There is also a set of possible options documented in
KB #175167.