PHP login cookie authentication I have the following code to do remember-me style login:

&lt;?php
session_start();
if(!isset($_SESSION['login'])) $_SESSION['login'] = 0;
if(isset($_COOKIE['web_login_cookie']) &amp;&amp; $_SESSION['login'] == 0) {
    $sql = mysql_query("SELECT * FROM users");
    while($row = mysql_fetch_array($sql)) {
        $pass = sha1($row['password'] . '@#$%$#%dsf@#$SDFg');
        if($_COOKIE['web_login_cookie'] == $pass) {
            $_SESSION['userID'] = $row['userID'];
            $_SESSION['login'] = 1;
            if($row['level'] == 1) {
                $_SESSION['admin'] = 1;
            }
        }
    }
    if(mysql_num_rows($sql) == 0) {
        setcookie("web_login_cookie", "", time()+(60*60*24*14));
        session_destroy();
    }
}
?&gt;


I have this code in my header file. Is this secure enough or will it pose any security risks in the future?
I don’t like the idea of storing the password hash in a cookie. It is easy to steal and grants unlimited access. The cookie is transmitted with every single HTTP request. I would prefer using an access token with limited lifetime. Anyway most people store passwords in their browser and this is easy to steal as well – so this seems not to be a massive security break.

The bigger problem is that your login only relies on the password – you don’t need to know the corresponding username to login. This makes brute forcing a lot easier. And more important: your login will break, if two users use the same password. Then user2 will (unintentionally) gain access to user1’s account.

PS: As mentioned in comments, don’t loop over every line in your table, use a WHERE clause instead. And I don’t understand, what you are trying to achieve with your mysql_num_rows code block…