This class can be dangerous.

This class can be dangerous. If PHP is configured to magic_quotes_gpc = off every hacker can succesfully login without using valid password. The simple solution is to type in this username to login without password:

<existing_username>' --

So for example to login as admin, you should type in:

admin'--

(with single quote and two minuses at the end). This is called SQL injection (and this is the simple one;))

Next time try to use mysql_real_escape_string() to sanitize your input

thank you for your wise observation. did you try my class with magic_quotes_gpc=off
if you do this admin'-- without password then it will show "query could not executed"

anyway I plan to add those security matters. so thank you for review my class.

changes are made