mysql_real_escape_string()

<?php
    require('connect/connect.php');
    ob_start();
    session_start();
    error_reporting(E_ALL & ~E_NOTICE & ~E_DEPRECATED);

    $user='phat123';
    $password='1234';


    echo $query = sprintf("SELECT * FROM user WHERE username='%s' AND pass='%s'",
            mysql_real_escape_string($user),
            mysql_real_escape_string($password));
?>