title: Is this vulnerable to SQL injection
body: <p>I realize there are a lot of questions already about this. But my method isn't the same as theirs, so I wanted to know. I think I understand SQL, but I don't want to risk making a mistake in the future, so thanks for any help. (This is just a project I'm doing, not homework or anything important). </p>
  
  <pre><code>function checkLogin($username, $password) {
      $username = strtolower($username);
      connectToDatabase();
      $result = mysql_query("SELECT * FROM `users` WHERE username='$username'");
      $dbpassword = "";
  while($row = mysql_fetch_array($result))
    {
      $rowuser = $row['username'];
    if($username != $row['username']) continue;
    $dbpassword = $row['password'];
    }
      if($dbpassword == "") {
          return false;
      }
      $genpass = generatePassword($password);
     return $genpass == $dbpassword;
  }
  </code></pre>
  
  <p>So hit me with your best shot :)
  And I don't think my method is as efficient as it could be. I don't understand php enough to understand what <code>$row = mysql_fetch_array($result)</code> is doing unfortunately.</p>