(Oh, the basic jist of it is that you need to query the DB using the provided UserName and PW. Count the number of rows, and if that count = 0, then you know they entered one of the two wrong. You can do individual queries to check the UserName and PW separately also.
As far as the allowing certain pages is concerned, sessions is a start. You need to have some sort of security applied to the user in the table, and check the table after they login, load it into a session, and do a quick check on the page you want to restrict... Basically, if the user's security level is 1, don't give access, if not, then give access... That's basic, but you get the idea.)