COOKIES and SESSION logon problems

I have a few questions about COOKIES and SESSION logon. on the page after successful logon, how can I determine whether the user is logged on? what I wrote was to get the SESSION user name and password to the database, and then compare them to the correct one. someone said that as long as the SESSION exists, even if the login does not exist, the user will jump COOKIES and SESSION logon issues on the logon page
I have a few questions to help you solve.

1. how can I determine whether a user is logged on to the page after successful logon?
What I write myself is to get the SESSION user name and password to the database. the correct comparison is considered as login.
Some people say that as long as the existence of a SESSION exists, even if the logon does not exist, the logon page is displayed.
Is the second method safe? Can SESSION and COOKIES be forged and directly logged on?

2. I used to log on only using SESSION. now I want to add the function of saving COOKIES automatically. Do I still need to use SESSION?
What is the overall idea?

------ Solution --------------------
To determine whether a user has logged on, you only need to determine whether there is a record in the session.
If you are worried about session forgery, do you not worry about forgery or leakage if you have both the user name and password in the session?

After all, the cookie is stored on the client and transmitted over the network, which is likely to be stolen.

------ Solution --------------------
Discussion

A friend gave me a method
Just add the following sentence after setting the session.
Setcookie (session_name (), session_id (), time () + 2592000 ,"/");

But I don't quite understand what this sentence means.

------ Solution --------------------
Cookie is required for automatic logon. Otherwise, how does the server know who is the cookie?
The cookie needs to save the user name with an invalid period, and you can also save an identifier string processed by user information.
When php receives the cookie, it considers that the user has logged on
If verification is required, the user's identification string is calculated and compared with the passed identity string.