How NOT to use SQL

sqlnono.php

<?php
$sql = sprintf( "SELECT `Password`, `DealerID`
		FROM `DLMAST`
		WHERE `DealerID` = %d
		AND LOWER(`Password`) = '%s'",
		mysql_real_escape_string( $_POST['Username'] ),
		mysql_real_escape_string( strtolower( $_POST['Password'] ) ) );
$db->Execute( $sql, 'user_pass' );