very simple login script (checking 2 variables before writing cookie)

The original script by @MDGM sets a cookie after matching only the username. @somedude3488 and @ryan_vietnow suggested adding the password check in the query, which fixes the immediate logic hole but still leaves two big problems: SQL injection (never interpolate raw input into SQL) and storing/compared plain-text passwords. For session-based access, a single DB check at login followed by server-side session state is the right approach; for long-lived logins (the "remember me" case @Spaiz asked about) use a secure token scheme, not a raw cookie with credentials.

A minimal, modern login flow:

• Store only hashed passwords (bcrypt/argon2 via password_hash) in the DB.
• Authenticate with a prepared statement, then password_verify.
• On success, call session_start() and session_regenerate_id(true), then store the user id in $_SESSION.

Example (PDO + password_verify):

$stmt = $pdo->prepare('SELECT id, password_hash FROM users WHERE username = :u');
$stmt->execute([':u' => $username]);
$user = $stmt->fetch(PDO::FETCH_ASSOC);

if ($user && password_verify($inputPassword, $user['password_hash'])) {
    session_start();
    session_regenerate_id(true);
    $_SESSION['user_id'] = $user['id'];
}

For persistent "remember me" logins, use a selector/validator token pair: store the selector and a hashed validator in the database, set a cookie with the raw selector:validator, and on return locate the selector, hash the validator, and compare with hash_equals. Rotate tokens after use and enforce expiry.

Token generation example:

$selector = bin2hex(random_bytes(9));
$validator = bin2hex(random_bytes(33));
$hash = hash('sha256', $validator);
$expires = time() + 30*24*60*60;

$pdo->prepare('INSERT INTO auth_tokens (user_id, selector, token_hash, expires) VALUES (?, ?, ?, ?)')
    ->execute([$userId, $selector, $hash, date('Y-m-d H:i:s', $expires)]);

setcookie('remember', $selector . ':' . $validator, [
  'expires' => $expires,
  'path' => '/',
  'secure' => true,
  'httponly' => true,
  'samesite' => 'Lax'
]);

Checklist: use HTTPS, HttpOnly/Secure/SameSite cookies, prepared statements (PDO/MySQLi), password hashing (password_hash/password_verify), session ID regeneration, rate-limiting and account lockout on repeated failures, and migrate any plain-text passwords by re-hashing at next login. See the PHP docs for password_hash/password_verify and PDO, and OWASP's Authentication and Session Management guidance for more details (password_hash, password_verify, PDO, OWASP Authentication Cheat Sheet).