Question: What is the best way to securely authenticate a user ?

So far I was thinking of:

* Generate a random `$SALT` for each successful login and store `$logged = md5($hashed_password.$SALT)` into database; delete on logout.
* Store `$logged` into a cookie (If user checked "remember me"). Set `$_SESSION['user'] = $logged;`
* On a visit: Check if `$_SESSION['user']` is set; if not, check for cookie, if data doesn't match, redirect to `login` page.

What are the risks ?

Answer: 
The first step is a bit overkill, as this is what `$_SESSION['foo']` basically does client-side for the lifetime of the session. I'd just store a salted and hashed password for each user to begin with, salting with the date or other pseudo-random factors.

Setting the cookie might prove useless if the user clears their cookies, or the session expires. This will leave the user logged in (according to your database) when in reality they're not.

I'd stick to just `$_SESSION['foo']` and cookies and leave the database out of the login process.
In first point you have mentioned It create random SALT string when user logged in and clear it when user log out. 

1. Main problem is you have to check SALT string is exist or not in each redirection of page. So it create heavy traffic in Database server.
2. Yes this is very useful for checkout user already logged in or not.
3. But in case of power failure in client machine after log in when Salt string remain in database after long time.

In second point to user authentication in cookie it is not secure. Client can easily show authentication cookie in browser

In third point to store authentication in session it means create session variable on server side and store it in file on server side. It is very secure then store it in cookie.

The best way to authentication is combine point number 1 and 3 which you mention. 

1. You can check user already logged in form other pc or not?
2. You can easily clear SALT string if session is not exist.
3. You can easily manage Login in case of pc power failure