Congrats.
Dameon's right: you shouldn't be pulling all the users out of the database in order to find one. It's slow and not necessary. Try this:
...
$sql = 'SELECT * FROM `users` WHERE username = \'' . mysql_real_escape_string($user) . '\'';
...
$result = mysql_fetch_array($query);
if ($result && ($new_user == $result['username']) && ($new_password == $result['password'])) {
...