I've read that for security matters, would be better to let a php script deal with database userid and password rather than a java applet.
That certainly depends. But why you would use a php script rather than a Java servlet is a bit strange. Because the php runs on a server, and a java applet on a client, someone with a good packet sniffer can theoretically gain userid and password from a java applet.
As opposed to just getting it from the POST data? A Java applet offers significant benefits over a HTTP POST request - you don't even need a packet sniffer to get username/password - you just need to look at the HTTP header. The books links you provided have proven to be very handy, thank you.
There are more, but those should get you started. Also it's hard to beat experience.