First off, do some reading on SQL injection and how to prevent it. You need to validate all user input where there is a risk that a user could retrieve information from an SQL database that they shouldn't be seeing, such as usernames and passwords etc. This includes parameters passed from page to page using the GET method.
On the subject of passwords, use encryption. PHP is capable of generating MD5 hashes from any string. So when a user registers, store their password as a MD5 hash. When they log in, MD5 their input and compare that against the hash in the database. The hash itself is next to useless for login purposes. If anybody happens to get hold of the MD5 hash, your login script will MD5 that and result in something completely different, so even that won't help them to get in.
That should be plenty for you to be going on with.
[edit] One more thing - use strong passwords for admin logins etc. Long combinations of lower and upper case characters, and numbers. The longer, the better.
On the subject of passwords, use encryption. PHP is capable of generating MD5 hashes from any string. So when a user registers, store their password as a MD5 hash. When they log in, MD5 their input and compare that against the hash in the database. The hash itself is next to useless for login purposes. If anybody happens to get hold of the MD5 hash, your login script will MD5 that and result in something completely different, so even that won't help them to get in.
That should be plenty for you to be going on with.
[edit] One more thing - use strong passwords for admin logins etc. Long combinations of lower and upper case characters, and numbers. The longer, the better.