The username field should be either unique or the primary key. That will enforce integrity rules on a system. Generally speaking the whole point of a username is to have a unique identifier.
ccoonen: You should check out my article on MySQL injection protection at
TUTORIAL: MySQL Injection Attack Prevention in PHP . You're using mysql_real_escape_string which has a few limitations (noted on the php.net site too).