Of everything, there are only a couple points that I want to pursue:
I'm criticizing his code and trying to help him learn how to better implement his ideas in PHP. I'm not trying to be mean or anything.
There's a way to criticize code to help, and a way to criticize to be mean. I suspect that your original post reflected the latter, but I could be mistaken.
md5 is infitely easier to collide than sha1, and if someone hijacked an admin cookie, they could easily log in as the superuser.
The only way to find a collision is to control two different plaintext messages and force them to hash to the same. Both SHA1 and MD5 are vulnerable to that, but that only affects very rare cases. In general, to store password or other sensitive data in a non-reversable form, MD5 and SHA1 are still fairly strong.
Yes, there is a slightly higher chance that "Lovecraft" and "Cthulhu" will collide on MD5 than on SHA1, but it's such a miniscule difference that it's not worth considering.
You really shouldn't store the password in a cookie in any form, technically. I tend to use a disposable token, like the session variable, that expires when the cookie expires.
