title: can I improve my PHP log-in system with cookies?
body: <p>I'm currently testing a simple log-in system I've made. What the script does is it checks the username and password I've entered with the ones in my database and if they both match, it sets the username to a session variable. When I go to a "members only" page, it will check to see if the session variable exists, if it does not exist, the user cannot view the content. It seems to work as intended. Based on the above info, here are my questions:</p>
  
  <ol>
  <li><p>What vulnerabilities/flaws are there to my method?</p></li>
  <li><p>Can cookies make it more secure? If so, how would it do so with relation to my code?</p></li>
  </ol>
  
  <p>Here's what I'm working with so far:</p>
  
  <p>username and password check:</p>
  
  <pre><code>&lt;?
  session_start();
  
  $username = $_POST['username'];
  $password = $_POST['password'];
  
  if ($username &amp;&amp; $password){
  $query = mysql_query("SELECT * FROM user WHERE username='$username' ");
  $numrows = mysql_num_rows($query);
  
      //if user exists
      if ($numrows !=0){
          while ($row = mysql_fetch_array($query)){
                  $dbusername = $row['username'];
                  $dbpassword = $row['password'];
              }
  
          if ($username == $dbusername &amp;&amp; md5($password) == $dbpassword){
              echo 'You\'re in! &lt;a href="member.php"&gt;Click&lt;/a&gt; here to enter the member page.';   
              $_SESSION['username'] = $dbusername;
  
          }
          else
              echo "incorrect password!";
      }
      else
          die("sorry, that user doesn't exist!");
  }
  
  
  
  ?&gt;
  </code></pre>
  
  <p>members only page:</p>
  
  <pre><code>&lt;?
  session_start();
  
  
  if ($_SESSION['username']){
  echo "Welcome, ".$_SESSION['username']."!&lt;br&gt;
  &lt;a href='changepassword.php'&gt;Change password&lt;/a&gt;
  ";
  }
  else{
  echo "please log in";   
  }
  ?&gt;
  </code></pre>