title: Sql injection and how to validate it in php
body: <p>Is the following code vulnerable to Sql injections and how to validate it ?  </p>
  
  <pre><code>$query=("select * from table2 where username = '$username'and password='$password'");
  $result=  mysqli_query($connect, $query);
         $row=  mysqli_fetch_assoc($result);
      if  ($username==$row['username']&amp;&amp;$password==$row['password'])
      {
          header('location:header.php');//to go header
          }
  else
  {
      header('location:insert_p.php');}
  </code></pre>