$nr = $mysqli->prepare("SELECT * FROM users WHERE username = '?' AND password = '?'");
  $nr->bind_param("sis", '$username', '$password');