Checking username and password in PHP

See more:

PHP

MySQL

Hello, I am a beginner.
For checking username and password:

<pre><?php
<?php
if ($_SERVER['REQUEST_METHOD']=='POST'){
$username = $_POST['username'];
$password = $_POST['password'];
require_once('dbConnect.php');
$sql= "SELECT * FROM user WHERE username = '$username' AND password = '$password' ";
$result = mysqli_query($con,$sql);
$check = mysqli_fetch_array($result);
if(isset($check)){
echo 'success';
}else{
echo 'failure';
}
}
?>

But when I get variables from users it isn't secure.
How can I use '?' and prepare the query and check results?


What I have tried:

checking username and password with

bind_param