Verificare username e password in PHP e MySQL

[Seven7]

$username=mysql_real_escape_string($_POST['username']);
$password=mysql_real_escape_string($_POST['password']);

$query = "SELECT username,password FROM clienti WHERE username='$username' AND password='$password'";
$risultato = mysql_query($query);

if(mysql_num_rows($risultato)>0)
{
header("Location: ../userpage.php")
}

   else
{
 errore
}