[XFlawless]

PHP Code:

<input type='submit' name="submit" value='Login' /> 
$submit = $_POST['submit']; //variable for submit button, in this variable we save button that player press in <input type='submit' name="submit" value='Login' />.... 


Why in the world do you need a submit variable it doesn't store any result

PHP Code:

if($submit) //if he press submit button 
{     
    if($username && $password) //if he type both of username and password not just one of them 
    { 
        $query = mysql_query("SELECT username, password FROM users WHERE username = '$username'"); //selecting user name and password, change it to your field names,  chage users to your table name, $username means username that he type... 
        if(mysql_num_rows($query) == 1) //if user exists 
        { 
            while($row = mysql_fetch_assoc($query)) //loop thought table that we select in mysql_query 
            { 
                $dbusername = $row['username']; //setting dbusername as variable from table, change 'username' to your field! 
                $dbpassword = $row['password']; //setting dbpassword as variable from table, change 'password' to your field! 
            } 
            if($username == $dbusername && $password == $dbpassword) //if username is same as one from table and if password is the same as one from table... 
            { 
                $_SESSION['username'] = $dbusername; //setting session username to one from table, this is useful if you login, that restart your browser and than you go in url where is your profile.php... Anyway this is useful :D 
                echo header('location: profile.php'); //redirecting user to his profile page (profile.php) 
            } 
            else echo "Wrong password!"; //else if user type wrong password he will get this... 
        } 
        else echo "Username doesn't exist!"; //if username doesn't exist in table user will get this 
    } 
    else echo "Type name and password!"; //else if user doesn't type all fields he will get this... 
} 


You are doing it the messed way, "SELECT username, password from users WHERE username = {$username} AND password = {$password}" would do it.

PHP Code:

if($username == $dbusername && $password == $dbpassword) 
{ 
       session_regenerate_id();// create another session id to prevent from session fixation.
       $_SESSION['username'] = $dbusername; // From here it's vulnerable to session fixation.
       header('location: profile.php'); 
} 


Use Jquery plugins like Flowtools form validator, they are easy to explain and validate form.