cookie encoding

[piggeh]

I've created a log in script that checks details against a database. If the login is successful then it sets a cookie on the machine to allow it to log in automatically in the future. My trouble is, somehow giving it some form of encryption, as at the moment, the cookie value is fairly basic (1,2,3..etc, basically the user id in the database). Someone suggested to me to just pick two numbers and create my own formula to make it harder to crack ,but is there a more secure way of doing it? Is there a built in PHP function to do it?

Any help appreciated.

[Iain]

there's no need to encrypt the user ID as it doesn't tell anyone anything about the user. It's important to encrypt any password details and the best way to do that is a one way encryption such as md5(). Basically what you do is encrypt the password before you set the cookie and then perform a SQL lookup based on the user ID, retrieve the password from the database, apply md5 encryption and then compare the md5 hash to that stored in the cookie. If they match then the user is correct.

Hope that helps

[piggeh]

well, there's no encryption at the moment, as I just populated the table to get the script working, but yeah that would work. Thanks for the advice.