Question: What is the best way to securely authenticate a user ?

So far I was thinking of:

* Generate a random `$SALT` for each successful login and store `$logged = md5($hashed_password.$SALT)` into database; delete on logout.
* Store `$logged` into a cookie (If user checked "remember me"). Set `$_SESSION['user'] = $logged;`
* On a visit: Check if `$_SESSION['user']` is set; if not, check for cookie, if data doesn't match, redirect to `login` page.

What are the risks ?

Answer: 
The first step is a bit overkill, as this is what `$_SESSION['foo']` basically does client-side for the lifetime of the session. I'd just store a salted and hashed password for each user to begin with, salting with the date or other pseudo-random factors.

Setting the cookie might prove useless if the user clears their cookies, or the session expires. This will leave the user logged in (according to your database) when in reality they're not.

I'd stick to just `$_SESSION['foo']` and cookies and leave the database out of the login process.
One problem I can see - your solution sounds annoying for people who load your site in multiple browsers at the same time.