to avoid mysql injections make sure you use this function in php:

mysql_real_escape_string()

so lets say that the username is the name of the field in your login form, im guessing you are using the POST method so this is how you would stop it

$myusername = mysql_real_escape_string($_POST['myusername']);

now you will stop from being hacked

hope that helps
https://www.webune.com/forums/how-to-prevent-sql-injection-attacks-in-mysql.html