Here is should say

{noformat}
$sql .= " username='" . mysql_real_escape_string($username) . "'";
{noformat}

-- we cannot be sure that `$clientId` will always come from a trusted source. What if someone does

{noformat}
$foo->findClientChanges($_GET['user_id'], $then, $now);
{noformat}

?