[Opserty]

Clean your variables:

PHP Code:

$username = mysql_real_escape_string($_POST['username']); 


Also add LIMIT 1 to the end of your query and fetch the password and username from the DB instead of querying twice. So you have something like
[sql]SELECT `username`,`password`, `salt` FROM tvgvbuser WHERE username='". $username ."' LIMIT 1[/sql]
The you can remove this:

PHP Code:

$query = mysql_query("SELECT * FROM tvgvbuser WHERE username='". $username ."' AND password='". $password ."'"); 
$result = mysql_num_rows($query); 
$row = mysql_fetch_array($query); 


And instead use something like:

PHP Code:

// I'm not a hundred percent sure if this works 
// You can maybe use:
// if(mysql_num_row($query) == 0) instead
if(!mysql_num_rows($query))
{
    // Wrong username but we won't tell them that
        echo 'Wrong combination of User Name and Password. Did you forget your Password? <a href="http://forums.tvgasm.com/login.php?do=lostpw" target="_blank"> Click here to retrieve it.</a>'; 
}
else
{
    $hashedpassword = md5(md5($password) . $salt);
    if($hashedpassword != $row['password'])
    {
        // Wrong username but we won't tell them that
            echo 'Wrong combination of User Name and Password. Did you forget your Password? <a href="http://forums.tvgasm.com/login.php?do=lostpw" target="_blank"> Click here to retrieve it.</a>'; 
    }
    else
    {
        // Do you session stuff here
    }
} 


There might be some parse errors...I'm using notepad