if (!empty($_POST['user']) && !empty($_POST['pass'])) {
	//if the user has sent a new user name and password, assign them to new variables
	$new_user = $_POST['user'];
	$new_password = sha1($_POST['pass']);
	
	$sqlCon = mysql_connect($db_host, $db_user, $db_password);
	//connect to the database
	$myDB = mysql_select_db($db_name, $sqlCon);
	//select the appropriate database
	$sql = 'SELECT * FROM `users`';
	//setup the sql
	$query = mysql_query($sql, $sqlCon);
	//send the query and then check for errors
	if (!$query) {
		die('Error: ' . mysql_error());
	}

<?php
session_start();

$_SESSION['user_name'] = $_COOKIE['user_name'];
$_SESSION['password'] = $_COOKIE['password'];

if (!empty($_SESSION['user_name']) && !empty($_SESSION['password'])) {
	$user=$_SESSION['user_name'];
	$password=$_SESSION['password'];
}

?>

...
$sql = 'SELECT * FROM `users` WHERE username = \'' . mysql_real_escape_string($user) . '\'';

...

$result = mysql_fetch_array($query);
if ($result && ($new_user == $result['username']) && ($new_password == $result['password'])) {
...