Este codigo evita sql injection?

[cslbcn]

Código PHP:

Pongo el codigo completo:
 
public function login($username,$password,$passwordNoMD5){
               
    $qry = "SELECT password FROM clients WHERE username='$username' AND password='$password' OR password='$passwordNoMD5'";
    if ($sql = mysql_query($qry)){
        $client = mysql_fetch_assoc($sql);
        if ($client['password'] == $password || $client['password'] == $passwordNoMD5){
            return true;                    
        }else
            return false;
}   
 
 
login($username,md5($password),$password);