title: Simple sql injection solution for login forms?
body: <p>I saw several examples and people using this way to query the database in a login form.
  I'm not fully sure is this is the best way to do a login form secure.</p>
  
  <p>This is the query in PHP:</p>
  
  <pre><code>    $query = "SELECT * FROM users WHERE usern = '".$_POST['username']."' AND passw = '".md5($_POST['password'])."'";
  </code></pre>
  
  <p>Is enough having md5() on the password post to avoid sql injection?.
  I think that the md5 function will convert all characters and sql strings to a 32 char string.</p>
  
  <p>Which other ways can I protect the login form?</p>