Like I earlier said, I totally pefer cookies over any method of logging in.
Although cookies can be intercepted, if you have everything that is valuable encrypted in the data before you set the cookie, you should be fine.
what I suggest is doing something like this:
$logged = "out";
if ($login == "new") {
mysql_connect($host,$user,$pass);
mysql_select_db($database);
$sql = mysql_query("SELECT * FROM $user_table");
while ($row = mysql_fetch_array($sql)) {
if ($username == $row[user] && $password == MD5($row[pass]) {
$logged = "in";
}
if ($logged == "out") {
echo "Error: Bad username/password combo.";
} else {
$encrypted_password = MD5($password);
setcookie("cookiename","$username:$encrypted_password",time()+3600,"/","domain.com",0);
echo "Welcome $username, you are logged in.";
}
}
}
That code will check in the mysql database (if you are using one) if the field "user" equals the username in the form (input name must be username to assign the variable, and likewise for password) and check if the encrypted version of the password they supplied equals the password in the database (which was stored encrypted).
To check a login, simply get the cookie data and explode it into an array.
$cookie = explode(":",$HTTP_COOKIE_VARS['cookiename']);
In this, the username from the cookie is $cookie[0] and the password is $cookie[1].
Hope you understood this :p
