Ejercicio Inyección SQL

function areUserAndPasswordValid($user, $password) {
	global $db, $userId;
	
	$query = SQLite3::escapeString('SELECT userId, password FROM users WHERE username = "' . $user . '"');

	$result = $db->query($query) or die ("Invalid query: " . $query . ". Field user introduced is: " . $user);
	$row = $result->fetchArray();	

	if ($row === FALSE) 
		return FALSE;
	
	if ($password == $row['password']) 
	{
		$userId = $row['userId'];
		$_COOKIE['userId'] = $userId;
		return TRUE;
	}
	else
	{
		return FALSE;
	}
}