user="user"
pass="pass"

if "'" in user+pass:
  print "error"

else
  db.execute("select * from users where username = '%s' and password = '%s'" % (username,password))