After you compared the login details the clients filled into the form with the account details in your database, and they match, write a session that stores the user id. Every new page they enter you can see if $_SESSION['user_id'] is empty or not. If it is empty, then let them redirect back to your homepage. If not, then the user is apparantly logged in and he may proceed.

Make sure you put everyones password as md5, sha or whatever hash algorithm in the database, and never as the original password. Just compare the encrypted password in the database with the password you get from the form after you encrypted it as well, and you know if there is a match.

I can't guarantee that this is the most safe method in the big meany world of the internut, but it should work fine. For more secure methods, there is plenty of information to find with googly.