[tbm]

$query = mysql_query("SELECT * FROM table where user=$user && password=$password");

תחליף ב

$query = mysql_query("SELECT * FROM table where user='$user' and password='$password'");