[Vince]

Use '%e' instead of '%s' for strings in mysql_format. Or use myqsl_real_escape_string beforehand. Make sure to do this in all queries. If you're asking here, chances are your login system is vulnerable to SQL injection attacks.