Storing Passwords Securely in Database and Cookies

/*
The userRegister function creates inserts the user entry to the database
The user data is passed in as an array $userData.
For simplicity and example, our $userData will only contain the username
and the password. And we will assume that a database connection already exists.
*/
function userRegister($userData)
{
    //Sanitize data and strip array to variables
    foreach($userData as $k=>$v)
        $$k = mysql_real_escape_string($v);

    //Generate salt
    $creation_salt = sha1($username.':'.time());
    $password = sha1($password.':'.$creation_salt);

    //Insert user
    $sql = <<<EOT
INSERT INTO `users`
(
`username`,
`password`,
`creation_salt`,
)
VALUES
(
'$username',
'$password',
'$creation_salt',
)
EOT;

    mysql_query($sql);

    return mysql_insert_id();
}

/*
The userLogin function checks login data and creates cookies
The login data is passed in as an array $loginData.
For simplicity and example, our $loginData will only contain the username
and the password. And we will assume that a database connection already exists.
*/
function userLogin($loginData)
{
    //Sanitize data and strip array to variables
    foreach($userData as $k=>$v)
        $$k = mysql_real_escape_string($v);

    //Query DB for user entry
    $sql = "SELECT * FROM `users` WHERE `username` = '{$username}'";
    $result = mysql_query($sql);
    if(mysql_num_rows($result) > 0)
    {
        $row = mysql_fetch_array($result);

        $passwordHash = sha1($password.':'.$row['creation_salt']);
        if($passwordHash === $row['password'])
        {
            $time = time() + 3600;

            set_cookie('username', $username, $time);
            set_cookie('password', XOREncrypt($password, $row['creation_salt']), $time);
        }
    }
}

/*
The loggedIn function checks cookies to see if user is logged in
For simplicity we will assume that a database connection already exists.
*/
function loggedIn()
{
    if(isset($_COOKIE['username']))
    {
        $sql = "SELECT * FROM `users` WHERE `username` = '{$_COOKIE['username']}'";
        $result = mysql_query($sql);
        if(mysql_num_rows($result) > 0)
        {
            $row = mysql_fetch_array($result);

            $password = XORDecrypt($_COOKIE['password'], $row['creation_salt']);
            $passwordHash = sha1($password.":".$row['creation_salt']);
            return ($row['password'] === $passwordHash);
        }
    }
    return false;
}

/*
The logout function clears the cookies
*/
function logout()
{
    $time = time() - 3600;
    setcookie('username', '', $time);
    setcookie('password', '', $time);
}

//Below are the XOR base64 encryption and decryption functions
//I did not write these functions but found them online a long time ago
//I can't remember who the original author is, but they are credited for this code

/**
 * XOR encrypts a given string with a given key phrase.
 *
 * @param     string    $InputString    Input string
 * @param     string    $KeyPhrase      Key phrase
 * @return    string    Encrypted string    
 */    
function XOREncryption($InputString, $KeyPhrase){
 
    $KeyPhraseLength = strlen($KeyPhrase);
 
    // Loop trough input string
    for ($i = 0; $i < strlen($InputString); $i++){
 
        // Get key phrase character position
        $rPos = $i % $KeyPhraseLength;
 
        // Magic happens here:
        $r = ord($InputString[$i]) ^ ord($KeyPhrase[$rPos]);
 
        // Replace characters
        $InputString[$i] = chr($r);
    }
 
    return $InputString;
}
 
// Helper functions, using base64 to
// create readable encrypted texts:
 
function XOREncrypt($InputString, $KeyPhrase){
    $InputString = XOREncryption($InputString, $KeyPhrase);
    $InputString = base64_encode($InputString);
    return $InputString;
}
 
function XORDecrypt($InputString, $KeyPhrase){
    $InputString = base64_decode($InputString);
    $InputString = XOREncryption($InputString, $KeyPhrase);
    return $InputString;
}