$username = mysql_real_escape_string($_POST['username']);
$password = md5($_POST['password']);
$query = "SELECT id FROM users WHERE username='".$username."' AND password='".$password."'";
$result = mysql_query($query);