I have the following code to do remember-me style login:<?phpsession_start();if(!isset($_SESSION['login'])) $_SESSION['login'] = 0;if(isset($_COOKIE['web_login_cookie']) && $_SESSION['login'] == 0) {    $sql = mysql_query(SELECT * FROM users);    while($row = mysql_fetch_array($sql)) {        $pass = sha1($row['password'] . '@#$%$#%dsf@#$SDFg');        if($_COOKIE['web_login_cookie'] == $pass) {            $_SESSION['userID'] = $row['userID'];            $_SESSION['login'] = 1;            if($row['level'] == 1) {                $_SESSION['admin'] = 1;            }        }    }    if(mysql_num_rows($sql) == 0) {        setcookie(web_login_cookie, , time()+(60*60*24*14));        session_destroy();    }}?>I have this code in my header file. Is this secure enough or will it pose any security risks in the future?
PHP login cookie authentication
php;mysql;authentication
I dont like the idea of storing the password hash in a cookie. It is easy to steal and grants unlimited access. The cookie is transmitted with every single HTTP request. I would prefer using an access token with limited lifetime. Anyway most people store passwords in their browser and this is easy to steal as well  so this seems not to be a massive security break.The bigger problem is that your login only relies on the password  you dont need to know the corresponding username to login. This makes brute forcing a lot easier. And more important: your login will break, if two users use the same password. Then user2 will (unintentionally) gain access to user1s account.PS: As mentioned in comments, dont loop over every line in your table, use a WHERE clause instead. And I dont understand, what you are trying to achieve with your mysql_num_rows code block