There can be some errors in the script, if u find them thanks, but the main thing is to get useful suggestions about how can I do this better and secure.ini_set('session.use_only_cookies', true); session_start();//Create a random salt value$salt = 'Hjkhkjh9089&j98098';$tokenstr = (str) date('W') . $salt; //Create a md5 hash to be used for token.$token = md5($tokenstr);///checking if already logged in if ($_REQUEST['token'] == $token AND $_SESSION['user_ip']=$_SERVER['REMOTE_ADDR'] ) {    ...grant user with some data }//user login block   if (($_POST['login']!=) OR ($_COOKIE[username]!='' AND $_COOKIE[password]!='') AND $_SESSION['user']=='') {    if ($_SESSION['temp_ban']==1)    {    $p='login_error';    }        else        {        $ip=$_SERVER['REMOTE_ADDR'];        $result2=  mysql_query(SELECT * FROM banned_ip_list WHERE banned_ip='$ip') or die(unable to connect to msql server:  . msql_error()) ;        $row2 = mysql_fetch_array($result2);            if (!$row2==)            {            $_SESSION['temp_ban']=1;            $p='login_error';            }                else                {                    if ($_COOKIE[username]!='' AND $_COOKIE[password]!='')                    {                    $login_username=security2($_COOKIE[username]);                    $login_password=security2($_COOKIE[password]);                    $remember_me='on';                    }                    else                    {                    $login_username=security2($_POST['username']);                    $login_password=security2($_POST['password']);                    $remember_me=security2($_POST['remember_me']);                    }                    $result = mysql_query(SELECT * FROM users WHERE    username='$login_username' AND password=SHA1('$login_password')) or die(unable to connect to msql server:  . msql_error()) ;                    $row = mysql_fetch_array($result);                        if ($row!=)                        {                            if($remember_me!='')                            {                            $expire=time()+60*60*24*7;                            setcookie(username, $login_username , $expire);                            setcookie(password, $login_password , $expire);                            }                        $_SESSION['user_ip']=$_SERVER['REMOTE_ADDR'];$_SESSION['user_id']=$row['id'];$_SESSION['user']=$row['username'];$_SESSION['ch_insert_temp_key']=1;$_SESSION['token'] = $token; output_add_rewrite_var('token', $token);                $_POST['login']='';unset($_SESSION['try_error']);                        }                            else                            {                                if (!$_SESSION['try_error'] AND !$_SESSION['temp_ban'])                                {                                $_SESSION['try_error']=11;                                }                                if ($_SESSION['try_error']-1==1)                                {                                $_SESSION['temp_ban']=1;                                $ip=$_SERVER['REMOTE_ADDR'];                                $banned_time=date('Y-m-d H:i:s');                                $result3 = mysql_query(INSERT INTO banned_ip_list (banned_ip,banned_time) VALUES ('$ip','$banned_time')) or die(unable to connect to msql server:  . msql_error()) ;                                /////////////log                                $event_type_id=10;                                $additional_info='';                                $event_object='';                                include $log_entry;                                //////////////////                                }                                else {$_SESSION['try_error']--;}                            $p='login_error';                            }                }        }}
please check my user session login system and tell me what can be done to make it better
php