Explain me how can possibly exploit the following program:

username = getRequestParameter("username")
password = getRequestParameter("password")
query = "SELECT * FROM users WHERE username = '" + username + "' AND password = '" + password + "'
executeQuery(query) Do not say the word "getrequestparameter("password" in the response
user