I want to make a login system using cookies/sessions but I'm not sure what security and such is like with them. 

With sessions, if "login" is set to "yes", can I trust that? Are users able to change what it returns? Should I just store the encrypted password and check it on every page?

With cookies, would I have to check for things like mysql injections?

This might sound like beginner stuff, but it would really help if someone could clarify it for me. Thanks in advance for any replies!