I use this block of code to check if the user is logged in (login stored in cookies as a plain text and pass MD5 crypted). As I'm a novice in PHP, I'm not sure that this is a correct way. Are there other easier ways of checking that you use?if(isset($_COOKIE['login']) AND isset($_COOKIE['pass'])){    $login = $_COOKIE['login'];    $pass =  $_COOKIE['pass'];    if($qw->query(SELECT count(id) FROM users where password = '.$pass.' and  email = '.$login.';)->fetchColumn() == 0){        setcookie('login','');        setcookie('pass','');        header('Location:auth.php');    }} else {    setcookie('login','');    setcookie('pass','');    header('Location:auth.php');    die();}
PHP Login Check
php;beginner;authentication
SecurityAs others have mentioned, this is not secure at all.Apart from the SQL injection (which can be fixed easily, your already using PDO anyways), the way your code works it doesn't matter that you are encrypting your passwords. You could change the weak md5 hashing to bcrypt or PBKDF2 and it wouldn't improve security one bit.(*)An attacker doesn't have to bruteforce your hash, as they can simply log-in with the hash.Cookies are stored and send by the user, and thus can be manipulated by an attacker. So if they gather a password hash, they can just set $_COOKIE['pass'] to it.The solution is to use sessions, which are stored on the server.(*) actually, users tend to reuse their passwords, so changing it would improve their security, but not the security of your serverCodeI would prefer email as the cookie name instead of login, making it clear what it should beI would also prefer passwordHash instead of pass for the variable and cookie name.You die if no cookies are set, but not if the check was unsuccessful. This doesn't seem right. If you redirect, always die.try to avoid nested if-else statements.you don't need to reset the cookie if it wasn't set in the first place.Your code might then look something like this:if(!isset($_COOKIE['email']) || !isset($_COOKIE['passwordHash'])){    header('Location:yoursite.com/auth.php');    die();}$email = $_COOKIE['email'];$passwordHash =  $_COOKIE['passwordHash'];if($qw->query(SELECT count(id) FROM users WHERE password = ' . $passwordHash . ' AND  email = ' . $email . ';)->fetchColumn() == 0){    setcookie('login', '');    setcookie('pass', '');    header('Location:yoursite.com/auth.php');    die();}If you want to avoid SQL injections, use something like this:$query = $qw->prepare(SELECT count(id) FROM users WHERE password = :passwordHash AND  email = :email);$query->bindParam(':passwordHash', $passwordHash);$query->bindParam(':email', $email);$queryResult = $query->execute()->fetch(PDO::FETCH_ASSOC);And check out this link to read about using sessions to check if a user is logged in (instead of using cookies).For better password hashing methods than md5, check out this post, especially the links on using bcrypt and pbkdf2 in PHP.