if(isset($_REQUEST['username']))
{
        $username = secure( $_REQUEST['username'] );
        $password = secure( $_REQUEST['password'] );

        $q1 = "select * from users where user = '$username' and parola = '$password' AND status = 1" ;
...

...
function secure($str){
        //pt siruri de caractere
        $str=htmlentities($str , ENT_QUOTES , "UTF-8" );
        return $str;
}
...