they can write an url like this
"www.yoururl.com?user=theirusername&password=theirpassword"
but it depend how you set your php variable
to avoiding that happen
you must turn of register_global in php.ini configuration
one more thing for safety you should hash/encrypt the user's password, so they can passing it to your url if they dont know
the encrypted password