[nicephotog]

$sql = "select username,password from faculty where (username=\"".$user."\" && password=\"".$pass."\")";

I find symbols prevent ambiguation with the query words
absolute on the quotes too.