SQL sorgu şifreyi doğrulanırken yaparken bir madde eksik görünüyor. (Eğer herhangi bir şey için karşılaştırarak değil çünkü) verilen kullanıcı adı veritabanında varsa WHERE username = '$loginUserName' AND '$loginPassWord' true değerlendirecek ve değeri $loginPassWord true değerlendirir.

Ayrıca, mysql_real_escape_string , in order to prevent SQL Injection krizi gibi bir şey kullanarak, bir veritabanı sorgu kullanmadan önce kullanıcıdan almak girdi kaçan edilmelidir.

Bir araya koyarak, ben gibi bir şey ile sorgu yerine koyuyordu:

$loginSubmitQuery = "SELECT username, password
  FROM users
  WHERE username = '" . mysql_real_escape_string($loginUserName) . "'
    AND password = '" . mysql_real_escape_string($loginPassWord) . "'";

It's also worth noting that you shouldn't store your users' passwords (plaintext) in the database.
It's extremely insecure and exposes your user in bad ways.

Kodlama Korku makalesinden alıntı You're Probably Storing Passwords Incorrectly:

Users collect usernames and passwords like they do Pokemon. It's a sorry state of affairs, but for better or worse, that's the way it is. We, as software developers, are trusted with storing all these usernames and passwords in some sort of database. The minute we store a user's password, we've taken on the responsibility of securing their password, too. Let's say a hacker somehow obtains a list of all our usernames and passwords. Either it was an inside job by someone who had access to the database, or the database was accidentally exposed to the public web. Doesn't matter how. It just happened.

(...)

You might think it's relatively unimportant if someone's forum password is exposed as plain text. After all, what's an attacker going to do with crappy forum credentials? Post angry messages on the user's behalf? But most users tend to re-use the same passwords, probably because they can't remember the two dozen unique usernames and passwords they're forced to have. So if you obtain their forum password, it's likely you also have the password to something a lot more dangerous: their online banking and PayPal.

Bu iki makale konunun biraz kapak ve ben bunu bir okuma almak öneririz.

Never store passwords in a database!

Enough With The Rainbow Tables: What You Need To Know About Secure Password Schemes

Kimlik doğrulama ile ilgili tavsiye iyi bir derleme de bu StackOverflow soru kontrol edebilirsiniz:

The Definitive Guide To Website Authentication (beta)

Edit in response to OP's comment:

Evet, ben aptal değilim ve sadece yazdıktan sonra gördüm ama açıklama hala geçerlidir.

You're using MD5 hashes but if you look at the linked articles you will see that MD5 alone is not enough and one can easily pick "most" of your passwords back if they have your database.
For a quick test, just throw an MD5 hash into google and you will see that unless your password is really wicked, you will get it back.

Daha iyi bir yaklaşım için her şifre için md5hash ve tuz gerekir, ama ben burada daha iyi anlatmaya çalışırken daha bağlantılı makale Enough With The Rainbow Tables: What You Need To Know About Secure Password Schemes okumanızı işaret ediyorum.

Bu doğru yapmak için basit, kolay bir yol var. :)

Ben kendi sözleriyle açıklamaya çalıştı ben yanlış yapardı eminim! :)

Şunu mu demek istediniz:

SELECT username,password FROM users WHERE username = '$loginUserName' and password = '$loginPassWord'

Yerine:

SELECT username,password FROM users WHERE username = '$loginUserName' and '$loginPassWord'