security - secure script action in php -

hi want ask security of "script action" in example

<form method="post" action="chek_user.php" enctype="multipart/form-data"/> 

and action

$username= htmlentities($_post['username']);     $mdp=htmlentities(md5($_post['pass']));    if($user->check_login($username,$mdp)==0)     {         $_session["ip"]=$_server["remote_addr"];         $_session["user_agent"]=$_server['http_user_agent'];         $_session["timestamp"] = time();         if (isset($_post['remembre']))        {        $expire = time() + 24*3600;        setcookie('user', $_session['user'], $expire);         }         header('location:indes.php');     }   else if ($user->check_login($username,$mdp)==-2)     {     echo 'no';     }  

never use setcookie() setup session state. should have session_start() in header file.

never use md5() extremely broken, sha1() on nist list of approved message digest functions (but kind of broken), sha2 family better, sha256() great choice you'll need find source code online because php doesn't have secure hash function. need salt, try searching 1 of 10,000+ posts relating password storage.

alwyas die() after header("location: ...");. function modifies http response header, the script still executes.

the entire session must on https. violating owasp a9. , yes, stackoverflow volates owasp, , they don't care.