to_owned() converts to a String, not to a &'static str. Those are not the same. You can't create a &'static str dynamically (though you can mutate one using unsafe.)
let _rows = sql_query("SELECT * FROM users WHERE username=?", &[username]);
The statement is static, but the [username] part is not, it's just a variable that can have whatever username you want.