That's why I try to avoid cookies except to hold generic information that the scripts only reference or if they do require, cross-reference before using (e.g. it stores username/id/joined-date (unix timestamp, makes it incredibly hard to guess), check to see if all 3 pieces match up, if not, log them out). The $_SESSION variable is reasonably nice and efficient as well and is entirely based on the user's browser.
Though I'll warn you, if a hacker wants to get in or screw with your website, it's only a matter of time. You're job is just to make sure they get frustrated and give up before they find a way in ;)
[Links]
http://www.google.com/search?q=php+secure+login
http://insanesecurity.info/blog/8-tips-for-a-secure-login-scriptadmin-panel
http://www.google.com/search?q=php+secure+cookie
http://thinkvitamin.com/dev/how-to-create-totally-secure-cookies/
