you can use sessions, but you need to make sure it's secure. do not use plain text passwords, or passwords at all, use a token system and go from there. otherwise, you can use a simple script for logins, i.e. no cookies just temporary data.
make sure to hash and salt the passwords and other sensitive information. also you might want to look into mysql injection, http headers, CSRF attacks, and XSS.
if you're using php 7.0 it has alot of built in features to protect against these things, i.e. PDO objects, built in sanitation handling, etc...