No password hashing? No SQL sanitizing? No sql prepared statements? Regardless of complexity, safely storing a password is a serious issue, and I strongly encourage that this should be taught from start.

It's not funny when a newcommer follows a tutorial, happens to have moderate success with his first attempts; and then all his user passwords are stolen and all the sql database was destroyed.

It isn't that hard either, specially considering nowadays there is a plug 'n play solution in phppass.
Prepared statements are as easy as normal queries, and they should be preferred when teaching.

Also, use parameterized queries to keep searches cleaner and quicker.

You don't have to loop through the entire set of rows. Where's the WHERE clause? Build a query which will complete something like "SELECT username, password FROM users WHERE Username = $username AND password = $password"