sqli

<?php
mysql_connect('localhost', 'user', 'pass') OR die(mysql_error());

$query = "SELECT * FROM users WHERE user='".$_POST['username']."' AND password='".$_POST['password']."'";
mysql_query($query);
?>