That differ a bit depending on what database you use. If you use mysql as a database you should use the command mysql_real_escape_string for all variables that you include in a query. You should also use ' signs, even for variables that don't actually need it, as example int. You could then do something like this:
$username = $_POST['username'];
$password = md5($_POST['password']); // I'm not sure if it is the correct way to use the hashing
$sql = sprintf("
SELECT COUNT(*) as c
FROM users
WHERE username = '%s'
AND password = '%s'",
mysql_real_escape_string($username),
$password);
$result = mysql_query($sql);
$row = mysql_fetch_row($result);
if ($row['c'] == 1)
{
// User is ok
}
else
{
// User is not ok
}
