Verifying User Login in SQL Injection

u_name = getRequestString("user_name");
u_pass = getRequestString("user_pass");  

sql = "SELECT * FROM users WHERE username ='" + u_name + "' AND pass ='" + u_pass + "'"