Making my User model class code more modular, and correct
There are a couple of things that I would personally change about the code, at the moment the model is doing far too much. It's pulling in cookies, request parameters and accessing the database. That's not the responsibility of the model, any domain logic should be separated from the models themselves.

First I would recommend moving the session and cookie related code somewhere more suitable, like a Filter, which can be ran before an action in a Controller is executed (if we're using the MVC pattern here).

Let's call our Filter class UserAuthFilter, before each request is routed to the relevant controller this class will intercept the request and check if the user is currently signed in.

class UserAuthFilter extends Filter {

    public function beforeAction(RequestHandler $request) {
        $uid = $request-&gt;session('uid');
        $sessionHash = $request-&gt;cookie('shash');

        //check if these variables are connected to a valid login
        if(/*we are logged in*/) {
            $user = ...;
            $request-&gt;set('user', $user);
        }

        return true; // continue with execution
    }
}


Second, I would recommend having your User model be nothing more than a representation of data. So no domain logic in the User class, just data. Anything database related we will move into a new class, let's call it UserRepository.

public class UserRepository {

    private $db; 

    public function __construct(Database $db) {
        $this-&gt;db = $db;
    }

    public function create($fname, $lname, $email, $password) {
        // create user
    }


    public function search($searchTerm) {
        // search for $searchTerm
    }

    public function getUserByCredentials($username, $password) {
        // find a user with the gieven username and password or return null/false      
    }
}


Now, the last thing left to refactor is the authentication side of things. To do this we'll create another new class, UserAuthService, which will handle authentication and session management.

public class UserAuthService {

    private $userRepo;

    public function __construct(UserRepository $userRepo) {
        $this-&gt;userRepo = $userRepo;
    }

    public function authenticate($username, $password) {
        $user = $this-&gt;userRepo-&gt;getUserByCredentials($username, $password);
        return $user === false ? false : $user;
    }

    public function logout(User $user) {
        // delete from sessions table where uid = $user-&gt;id
    }
}


Then instead of inserting into the session table from the UserAuthService on a successful login, from within your controller you check the credentials with a call to $userAuthService->authenticate(...) and if you get a valid result back, then you insert into the session table.

That's about all I can think of besides a couple of small improvements:


Give your classes meaningful names. RequestHandler doesn't seem like a suitable name given the calls you're making to it. Perhaps just Request would be better.
Try to keep your constructors as simple as possible, do you really need to be making calls to the database when a User object is created?


Hope this helps.