vulnerable stored procedure

/* don't do this on your server... */
CREATE PROCEDURE VerifyUser
    @username VARCHAR(50),
    @password VARCHAR(50)
AS
BEGIN
    DECLARE @SQL nvarchar(500);
    SET @SQL = 'select * from Usertable
                where username = ''' + @username + '''
                and password = ''' + @password + ''' ';
    EXEC(@SQL);
END