这段代码是安全的 - PHP && MySQL

<?php
class test_class {

        public function __construct() { 

        }
        public function doLogin($username,$password) {

            include("connection.php");

            $query = "SELECT *
                      FROM users
                      WHERE username = '".mysql_escape_string($username)."'
                      AND password = '".mysql_escape_string($password)."'";
            $result = mysql_fetch_array(mysql_query($query));
            if(!$result) {

            return 'no';
            }
            else 
                {
            return 'yes';
                }
            }


}
?>
<?php
class test_class {

        public functi