I am creating a 'remember me' function. I have tried to read many different documents and manuals to ensure that it is as secure as possible. 

As you can see, I am creating a $token which when verifying the cookie, we lookup in the MySQL database and find the user ID to log them in.

I just read another article which suggests that I should be storing a RANDOM token and also a VERIFIER that is SHA(384) into the cookie and then use both to look them up in the MySQL database. 

I can't see how that becomes any more secure than the implementation below, as if they somehow have the token, they would also have the verifier as well?

```
if ($remember == 1) { 
    $token = bin2hex(openssl_random_pseudo_bytes(16));
    // insert token into the mysql database
    $stmt = $pdo->prepare("INSERT INTO tokens (token, userid) VALUES(:token, :userid)");
    $stmt->execute(array( 
        'token' => $token,
        'userid' => $rRow->ID
    ));
    setcookie ("MCTOKEN", $token, time() + 2419200,'/', SITE_DOMAIN);
}

```