Efficiency with strcpy, strcat and malloc
Fairly good C. Few notes:


sizeof(char) is by 1 definition. It doesn't hurt to multiply by it, but still totally unnecessary.
malloc return value better be tested against NULL.
Calling functions of strn (emphasis on n) family in this context is kinda paranoid: you've already allocated enough memory; no need for extra safety. In fact, I'd rather go for sprintf("%s%s%s", querystring, query1, username, query2).
int comparison is just noise. It's OK to directly test results of strcmp(). BTW, strncmp in this context looks paranoid again.
I am not familiar with mysql. Shouldn't you release row somehow?