<?php
mysql_query("SELECT * FROM users
             WHERE username='%s'
                   AND password='%s'", mysql_real_escape_string($username), mysql_real_escape_string($password));
?>