ciao a tutti, sapete dirmi se questa queri e' giusta

$user=$_GET['user'];
$password=$_GET['password'];

$query=mysql_query("SELECT username, password FROM user_login WHERE username=$user AND password=$password");