I've written a simple PHP application (MyApp) that allows users to log into their Evernote account using Evernote's SDK for PHP. However, in my application, I want to do this:

1. User approves Evernote login
2. MyApp receives #1's requestToken, requestTokenSecret, etc.
3. MyApp stores #2 into a cookie and `$_SESSION`
4. When users later return to my site, MyApp logs them in via the cookie

Yes, I know that such cookie-based logins are insecure. My application however, stores no sensitive data. What is the simplest way to proceed? Here is my attempt:

```
//if cookie
if (isset($_COOKIE['requestToken'])) {
    $m = new mysqli(MYSQL_SERVER, MYSQL_USER, MYSQL_PASS, MYSQL_DB);
    $q = "SELECT uid FROM users WHERE token={$_COOKIE['requestToken']} and secret={$_COOKIE['requestTokenSecret']}";

   // cookie matches db?
   if ($result = $m->query($q)) { 
      $_SESSION['login']=TRUE;
      $result->close();
}
   else // no match
      $_SESSION['login']=FALSE; 
}
else { //no cookie - create
    if (EverNoteLogin()) {
       $year=time()+86400*365; //86400 = 1 day
       setcookie('requestToken',$_SESSION['requestToken'],$year); 
       setcookie('requestTokenSecret',$_SESSION['requestTokenSecret'],$year);
    }
}

```

**SUGGESTED IMPROVEMENTS VERSION**

```
//if cookie
if (isset($_COOKIE['requestToken'])) {
    //check db
    $m = new mysqli(MYSQL_SERVER, MYSQL_USER, MYSQL_PASS, MYSQL_DB);
    $s=$m->prepare("SELECT uid FROM user WHERE token=? AND secret=?");
    $s->bind_param('ss',$rt, $rs);
    $rt=$_COOKIE['requestToken'];
    $rs=$_COOKIE['requestTokenSecret'];
    $s->execute();
    $s->store_result(); 
    $n=$s->num_rows;
    //match db?
    if ($n) {
        if ($n==1) { // 1 match
                $s->bind_result($uid);
                $_SESSION['uid']=$uid;
                $_SESSION['login']=TRUE;
            }
        else
            $_SESSION['login']=FALSE; // >1 match not good
    }else
        $_SESSION['login']=FALSE;
}
else { //no cookie - create
    if (EverNoteLogin()) {
       $year=time()+86400*365; //86400 = 1 day
       setcookie('requestToken',$_SESSION['requestToken'],$year); 
       setcookie('requestTokenSecret',$_SESSION['requestTokenSecret'],$year);
    }
}

```