$username = mysql_real_escape_string(htmlspecialchars($_REQUEST["username"])); $password = mysql_real_escape_string(htmlspecialchars($_REQUEST["password"]));