Don't let it get too confusing, its much easier than you suspect.
I use both cookies and sessions (sometimes), here's how:
I create a 'user' class that has things like create(), update(), init(), delete() and does all the database calls for me.
I store all my passwords encrypted (one way hash) in the database upon user creation.
Let's say a registered user logs in. I just set the username for the class and then call the init method which will return true/false if it returned a record for that username. If so, I apply the same encryption method I use to store the password on the password that was submitted upon login. (confused yet?). If this matches the one in the database, the user is authenticated. I first register a session variable 'sesObjUser' and depending on if the user said 'save logins', i also set a cookie. i call the cookie 'userToken' or something similar that is in the form of <username>:<encrypted password>
at the top of each page, i check to see if the session object exists and is complete, if not, i look for the cookie. If the cookie exists, I call explode and repeat the steps above as if the user had logged in.
remember that when using objects stored in session, you must require/include the class definition BEFORE calling session_start()
good luck.
If you get stuck, email me.
