Of course Xenon, and thanks a lot for helping.
I asked about the security risks though, are they the only ones that you wrote on your first post? That's all I need to know for now :)

apart from the mentioned ones, i don't see any more

She can change her password, as often as she wants from the admincp (I forgot to mention it earlier)

As for the password, if I were you I would indeed encrypt it.

Adding a simple md5 should so, add one to the "register" form (guessing this is in the install script), and add an md5 hash to the password before it gets verified. (so basicly add $password = md5($password) before your password checking conditional ;))

Good luck! I personally find cookies and sessions a pain in the neck aswell, heh.