First, you'll want to know if the username and password they've provided matches against the records in the database. After doing that, you start a session (name based on their user_id or whatever).
Ex:
<?php
session_start();
$username = $_POST['username'];
$password = $_POST['password'];
// Assuming that you have hashed the password in the database
$hashed_pass = md5($password);
// Check it against the database
$query = mysql_query("SELECT * FROM users WHERE username = '$username' AND password = '$hashed_pass'") OR DIE (mysql_error());
// If they match, start a session
if(mysql_num_rows($query)>0) {
while($row = mysql_fetch_assoc($query);
extract($row);
// Assuming that you have a unique id number for each user (named user_id)
$_SESSION['uid'] = $user_id;
}
}
else {
return false;
}
?>