If you execute the first ssh command (fixed as described in the other posts) on the client machine (i.e., the one that you want to use to control the other), then that will encrypt all communication between client and server. Additional ssh port forwarding is unnecessary.

Indeed, the ssh command in Rob's edit doesn't really accomplish anything here. It takes all packets destined for port 1202 on the server machine and forwards them to port 5900. With this setup, though, you won't be sending any packets to port 1202 on the server side -- they're going to port 1202 on the client side, and the first ssh command takes care of the necessary forwarding.

Finally, if the server machine has a globally-visible hostname, you can use that instead of the IP address in the ssh command.