diff --git a/reference/mysql/functions/mysql-real-escape-string.xml b/reference/mysql/functions/mysql-real-escape-string.xml
index a423bb9cad..b98cf2eb24 100644
--- a/reference/mysql/functions/mysql-real-escape-string.xml
+++ b/reference/mysql/functions/mysql-real-escape-string.xml
@@ -83,14 +83,14 @@ $query = sprintf("SELECT * FROM users WHERE user='%s' AND password='%s'",
     <programlisting role="php">
 <![CDATA[
 <?php
-// Query database to check if there are any matching users
-$query = "SELECT * FROM users WHERE user='{$_POST['username']}' AND password='{$_POST['password']}'";
-mysql_query($query);
-
 // We didn't check $_POST['password'], it could be anything the user wanted! For example:
 $_POST['username'] = 'aidan';
 $_POST['password'] = "' OR ''='";
 
+// Query database to check if there are any matching users
+$query = "SELECT * FROM users WHERE user='{$_POST['username']}' AND password='{$_POST['password']}'";
+mysql_query($query);
+
 // This means the query sent to MySQL would be:
 echo $query;
 ?>