[Gavin B.]

When mysql returns the number of rows, if the username and password both match there will be 1 row. Otherwise no results are returned so the result is 0 So yes, the username and password need to match for 1 to be returned.

$valid is just a variable people use, nothing special about it, it's just convenient.

The last piece of code you have there is the HTML meta tag which redirects (or refreshes) a page. The one you have above waits 1 second (CONTENT=\"1\") then redirects the user to index.php

in case you're wondering about the backslashes \ they are there to 'escape' the quote marks " which would confuse PHP (as it's being echo'd out). It looks like this once it's been echo'd:
<META HTTP-EQUIV="Refresh" CONTENT="1; URL=index.php">