What is the security issue in this code?
Off the top of my head:


Those parameters don't seem to be escaped before being stitched into a query (opening up SQL injection attacks)
The database seems to be keeping passwords in plaintext rather than as salted hashes (which is an especially bad combo with the previous point)


You'd really want to 


escape the username and password before dropping them into a SELECT statement
keep the password stored as a hashed value at minimum (you'd then want to verify the users' input by hashing the password you get from them and comparing that to what you have stored). Ideally, you'd salt them too.


It wouldn't hurt to accept the login info as a POST parameter either (just to reduce the number of logs username/password combos would end up in).