First of all, the information the user submits isn't sent to the database, it is only cross-referenced to make sure the data they types is correct. For example:
PHP Code:
<?
$username = username submitted by user
$pass = password submitted by user
$login = mysql_query("SELECT * FROM login WHERE name='$username' AND pass='$pass'");
$login = mysql_fetch_array($login);
if(!$login){
$errormsg = "Incorrect Username/Password";
}else{
// add action for correct pass
}
?>
This is a brief example. Although this script will work, it is insecure.