This line

mysql_query("UPDATE accounts SET last_login='".time()."' WHERE username='".$_POST["user"]."'");

is open for sql injection attacks and XSS attacks. You should filter the input data from the user and use at least

mysql_real_escape_string()

if you are using mysql? And use htmlentities(), strip_tags().


Check this site out for help on security issues

http://phpsec.org/projects/guide/

Its an easy read and well worth it.