Fix SQL Injection in login.php

Cookies are user-provided data, and thus should be sanitized before using them in an SQL query.