Giving your tables obscure names is one precaution - however there are other, more important considerations too. Firstly, what version of PHP are you using - I'd recommend 5 if you have a choice 🙂.
How critical is security? For the most critical you should consider SSL as it incorportes data integrity, encryption and identification. The simplest of login system would authenticate the user and store a flag in a session on the server side that tells your application whether or not they have been authenticated. Implement the later over SSL with an encrpyted cookie and you'll have a very secure authentication system.
Heres a few tips:
Use one way encrpytion on passwords such as Md5 and encrypt and sensitive data relating to the user in the database such as credit card details.
Once a user has authenticated you will need to set up a session for them (so they don't have to keep logging in during the same browser session). PHP's session management is more than adequate.
Once the session has been set up it is vulnerable to hijack. The session is identified using an ID and one trivial security precaution you can take is to ensure that the session ID is sent in the HTTP header as a cookie by setting the session.use_only_cookies setting to 1 (this will prevent accidental hijacking only as the session ID will not be contained in the URL).
Other precautions you can take to ensure the session is fixed to one use is tie it to the users IP address and / or their user agent string and whenever they move to a more secure area, give them a new session ID and ask them to reconfirm their password.
Only ever store the data which is need in a session. Sensitive data should remain in the database and fetched only when needed. Doing it this way may encure a slight overhead but it will prevent sensitive data from being leaked should the session data be compromised.
Make your sessions expire. The easiest was to do this to store a UNIX time stamp as one of the variables and check it each time the session is loaded.
When the user logs in, ensure the data to be instered into an SQL sring is escaped using a function like mysql_escape_string() or the equivilent for the database server you are using.
In PHP 5 you should consider using PDO which supports stored procedures. Mysql 5 also supports stored procedures. Stored procedures allow you to execute predefined querys using aset of parameters which are escaped automatically.
Mysql 5 also allows you to define views. As the name suggests you can set up several user accounts and give each one a specific view of the same dtabase. I.e: while a login script will need to see the password field, a scritp which displays the users name and post count need not see it so it can be omitted from the view.
Obviously, the level of security you choose will determine which of these precautions you encorporate into your system. 🙂
