Any website that either doesn't encrypt passwords, or secures the strings, are hackable. Limiting the query for retrieving the user account details, on login, is important. As only one account should be retrieved. As it could be possible to dump the Db, if either the username or password string aren't secured (by using a MySql type command).
The check form was submitted, is to check the details were entered through the form and not the address bar.
if(isset(submit))
{
// form submitted
}
Encryption is important, with the expectation of double hashing. As if the strings are collided, it might be possible to remove both layers of encryption (if that's the right way of putting it).
Thou the user has an important part to play. As passwords with characters (*[]() etc) should be used, so the possibility of causing a collision is smaller. That with exotic forms of encryption, altering the password string with simple things like reversing the string, changing it to binary, adding characters to it and salting it, add a further layer of protection.
Thou probably the most overlooked part is the users email address, if you gain access to that, you gain access to what ever accounts that email was used to register with.
//Rant over
