title: Is this a secure way to structure a mysql_query in PHP
body: <p>I have tried and tried to achieve an SQL injection by making custom queries to the server outside of firefox.</p>
  
  <p>Inside the php, all variables are passed into the query in a string like this.</p>
  
  <p>Note, by this stage, $_POST has not been touched.</p>
  
  <pre><code>mysql_query('INSERT INTO users (password, username) VALUES(' . sha1($_POST['password']) . ',' . $_POST['username'] . '));
  </code></pre>
  
  <p>Is that a secure way to make a change?</p>