Session session = sessionFactory.openSession();
    Query q = session.createQuery("from Users u where u.username = :name and u.password = :pass");
    q.setParameter("name", username);
    q.setParameter("pass", password);
    Users user = (Users) q.uniqueResult();

2017-01-20 22:34:17 TRACE BasicBinder:83 - binding parameter [1] as [VARCHAR] - "test"
2017-01-20 22:34:17 TRACE BasicBinder:83 - binding parameter [2] as [VARCHAR] - "test"

user =  null

from Users u where u.username = 'test' and u.password = 'test'"