Q:

What is the vulnerability of this code snippet?

$stmt = $con->prepare("SELECT * FROM login WHERE username =? AND password = ? ")

$stmt->bind_param("ss", $username, $password)

$stmt->execute();

A:

There should be no vulnerability in your code snippet, at least not from the point of SQL injection.  However, I see another problem, which is that it appears you are storing clear text passwords into your login table.  Instead, consider following the safer pattern of first hashing the user passwords with a salt, and then storing this hashed value in the table.  Then, when a user does a login, you would again hash the incoming password to compare against what is stored in the login table.  This avoids the risk of someone malicious accidentally getting access to every user password.

