Now the script should be less vulnerable to SQL injections:
* Used prepare/execute statements on all database queries that process input
  (like cookies).
* Cookies now have the secure option (only https) enabled.

And a minor edit: the form in the script would still send itself to index2.php
(which is now called index.php). Fixed that.