Okay so I'm trying to make my login script a tad more secure then just setting cookies and calling it a day.

I've been looking at using SESSIONS (the way I should have been doing it from the beginning), but I'm unclear on the difference between SESSIONs and COOKIEs as far as security.

Also, I mean, should my script just poll the database for an entry with a matching email, check the password and then set the session values??

Oh and as for storing password... MD5 encryption the way to go?