[RESOLVED] Form Cookies Security

[penagate]

If a user "sniff"/grabs the cookies of another user then it can replace/add these cookies with a tool and then refresh the page.
After that, it will be automatically authenticate.

This is true of any automatic login method. But regardless, passwords should never be sent in clear text. SSL should be used for a security-critical login method so that the data cannot be sniffed by a malicious third party. For automatic logins, usually some kind of login token is used rather than a hash of the user's password; this then creates a pre-authenticated session.

There are superior hash algorithms available than SHA1 or MD5, too, like Whirlpool or RIPEMD.

But you knew all that, right?