PHP login cookies security
<p>In most of past questions on SO about security in 'Remember me' feature in login systems, <a href="http://fishbowl.pastiche.org/2004/01/19/persistent_login_cookie_best_practice/" rel="nofollow">Persistent Login Cookie Best Practice</a> is suggested.</p>

<p>If I understand correctly, this approach goes like this:</p>

<ol>
<li><p>If user checks to remember the password, the cookie consisting the username, followed by a separator character, and some large random number should be set. For example:</p>

<p><code>$_COOKIE["login"]; ="adam:8794383bb07608636dab808df6c9e29c"</code></p></li>
<li>store username and hash string in database.</li>
<li>if both cookies exist, and are mapped to each other in db, the login is accepted.</li>
<li>After authentication, remove the random number from cookie, generate a new number and store in cookie. (<strong>Do I need to update this newely generated hashed string in the database as well?</strong>)</li>
<li>When user is logged out, current cookie number is also invalidated.(<strong>Should I remove username and the random string from the database?</strong>)</li>
</ol>

<p><strong>Is  it all?</strong> </p>

<p>As in my previous question, I was told that if someone can access the cookie, they can easily authenticate. So how does this approach solves that problem?</p>

<p>Many thanks.</p>
