question on sql injection

Yes it is vulnerable. Any time you take a value from somewhere that the user can enter data and plug that value directly into a query, you can get SQL injected. Imagine if the user entered their password as ' OR 1=1 --. Then you'd get

SELECT * FROM users WHERE user_name = <some value> AND password = '' OR 1=1 --'

You never want to take a value that the user could enter and plug that directly into a query. Also remember that a user can modify the HTML of your page so you don't want to take any value from the page and plug that directly into a query either. Take a look at this link for a better explanation and for how to prevent this http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php

Yes, it's in danger of sql injection. Here's an example of how a sql injection attack could be used to manipulate your code:

$username = $_POST['username']; // = user
$password = $_POST['password']; // = anything' OR password LIKE '%
$sql = "SELECT * FROM users WHERE user_name = '$username' AND password = '$password'";

// Resulting Statement
// SELECT * FROM users WHERE user_name = 'user' AND password = 'anything' OR password LIKE '%'

By not escaping, validating, or using prepared statements, an attacker could pass additional sql into the form input. In my example, I was able to pass additional sql through the password input field. This SQL adds an OR statement to the query that will match any password in the database equal to any number of character, even zero. This code would return multiple users because it matches every password. Your application will most likely be expecting a single row to be returned from the database so it shouldn't work on a production site. That said, there are far more aggressive code examples that could be passed into username field. Code that could result it some very very bad outcomes.

I would strongly recommend looking at implementing PDO and prepared statements. You can read more about Prepared Statements on the PHP website here: http://www.php.net/pdo.prepared-statements.

Bottom line, never trust user provided data! Escape, Validate & Prepare Statements!

Ryan

so I should prepare the query and then bind the params, then execute?