Login & Cookie Security

[eluser]georgerobbo[/eluser]
Hello,

I have a few questions about login and cookie security.


Of course you should have all passwords in your database encrypted. However is it possible to intercept the password or any data from a form before it is encrypted by the server?

Secondly when setting a cookie after a user has logged in should you do:

a cookie with a value set to true to say they are logged in

or a cookie containing a username and another containing their encrypted password / or a specific session ID?