coockie

<?php
session_start();
if(isset($_POST['login'])) {
    require_once "../engine.php";
    $error = "";
    $FATAL = FALSE;
    $login = $_POST['login'];
    $password = $_POST['password'];
    $autoenter = checkbox_verify('autoenter');
    sanitizeString($login);
    sanitizeString($password);
    if ($login == "" || $password == "") {
        $error = "Заполнены не все поля";
        $FATAL = TRUE;
    }
    else {
        require_once "login.php";
    }
    if ($FATAL == TRUE) {
    ?>
    <div class="error">
        <?php echo $error ?>
    </div>
    <?php
    }
    else {
        require_once "userstrukture.php";
    }
}
echo $COO;
?>
<script>
    showTextarea(<?php echo $loggedin ?>,'','');
</script>

<?php
$query = "SELECT * FROM hpmembers WHERE login='$login' AND password='$password'";
        $result = queryMysql($query);
        if(mysql_num_rows($result)) {
            $row = mysql_fetch_row($result);
            $id = stripslashes($row[0]); // ID
            $res = stripslashes($row[1]); // Login
            $_SESSION['user'] = $login;
            $_SESSION['userid'] = $id;
            require_once "getuserinfo.php";
            $loggedin = 1;
            if ($autoenter == 1) {
                setcookie('login', "$login", time() + 259200);
                setcookie('password', "$password", time() + 259200);
                if(setcookie('auto', 'yes', time() + 259200)) {
                    $COO = "ОТПРАВЛЕНО";
                }
                else $COO = "ОШИБКА";
            }
        }
        else {
            $error = "Неправильный логин/пароль";
            $FATAL = TRUE;
            $loggedin = 2;
        }
?>

<?php
    $query_info = "SELECT * FROM hpuserinfo WHERE id='$id'";
    $result_info = queryMysql($query_info);
    $row_info = mysql_fetch_row($result_info);
    $name = stripslashes($row_info[1]); // name
    $surname = stripslashes($row_info[2]); // surname
    $query_message = "SELECT * FROM hpmessages WHERE whom='$id' AND readbl='FALSE'";
    $result_message = queryMysql($query_message);
    if(mysql_num_rows($result_message)) {
        $count_query = "SELECT count(1) FROM hpmessages WHERE whom='$id' AND readbl='FALSE'";
        $handle = queryMysql($count_query);
        $tmp  = mysql_fetch_array($handle);
        $messagecount = $tmp[0];
    }
    else {
        $messagecount = "0";
    }
?>

function queryMysql($query) {
    $result = mysql_query($query) or die(mysql_error());
    return $result;
}

function sanitizeString($var) {
    if (function_exists('get_magic_quotes_gpc') && get_magic_quotes_gpc()) {
        $str = stripslashes($var);
        $str = mysql_real_escape_string($var);
    } 
    else {
        $str = mysql_real_escape_string($var);
    }
    $var = strip_tags($var);
    return $var;
}

function checkbox_verify($_name) {
    $result=0;
    if (isset($_REQUEST[$_name])) {
        if ($_REQUEST[$_name]=='on') { 
            $result=1; 
        } 
        else { 
            $result=0; 
        }
    }
    return $result;
}