Q:

What cookie request is a suspect request?

I have this table which is containing all users' cookies: (about being login. that's actually "remember me checked")
// cookies
+----+---------+-------------------+------------+
| id | user_id |       token       |   expire   |
+----+---------+-------------------+------------+
| 1  | 32423   | dki3j4rf9u3e40... | 1467586386 |
| 2  | 65734   | erhj5473fv34gv... | 1467586521 |
| 3  | 21432   | 8u34ijf34t43gf... | 1467586640 |
+----+---------+-------------------+------------+

And I check both user_id and token columns to validate an cookie:
SELECT 1
FROM cookies
WHERE user_id = :id AND
      token   = :token

Well there is 5 cases:

row exists
row doesn't exist because user_id = :id is false
row doesn't exist because token = :token is false
row doesn't exist because both user_id = :id and token = :token are false
row doesn't exist because user_id = :id and token = :token are true but not in the same row.

My Question: Which case is dangerous and I have to care about it? Which one isn't important and I have to ignore it? 

Ok well, what about this theory? "No need to check user_id column at all:"
SELECT 1
FROM cookies
WHERE token = :token

So there is just two cases:

row exists
row doesn't exist because token = :token is false

And then nothing there is suspicious. So is this theory good (secure)?

A:

If you ensure your token contains enough entropy (> 128 bits), then you shouldn't need to check user ID as well.
I would also store the token hashed within your database using something at least as secure as SHA-2, that way if your remember-me table is compromised in any way, an attacker can't hijack sessions. The cookie set on the client should be the raw value. Note that salt is not needed for sufficiently strong random values.

