Question: What is the best way to securely authenticate a user ?

So far I was thinking of:

* Generate a random `$SALT` for each successful login and store `$logged = md5($hashed_password.$SALT)` into database; delete on logout.
* Store `$logged` into a cookie (If user checked "remember me"). Set `$_SESSION['user'] = $logged;`
* On a visit: Check if `$_SESSION['user']` is set; if not, check for cookie, if data doesn't match, redirect to `login` page.

What are the risks ?

Answer: 
The only issue I can see with your existing framework (which I like otherwise) is that there is the possibility of collision for `$logged`.

It is not mathematically impossible for two valid user log-ins to result in the same hash. So I would just make sure to start storing the User `id` or some other unique information in the Cookie as well.

You may also want to keep a timestamp of when the `$logged` was put in the DB, so that you can run cleaning queries where they are older than `x` days/weeks.
The first step is a bit overkill, as this is what `$_SESSION['foo']` basically does client-side for the lifetime of the session. I'd just store a salted and hashed password for each user to begin with, salting with the date or other pseudo-random factors.

Setting the cookie might prove useless if the user clears their cookies, or the session expires. This will leave the user logged in (according to your database) when in reality they're not.

I'd stick to just `$_SESSION['foo']` and cookies and leave the database out of the login process.