查询语句加条件and后面的密码查询不到

case 'denUser':

$sql="select * from user where username='{$username}' and password='{$password}'";

$result=$mysqli->query($sql);

var_dump($result);

if($result && $result->num_rows>0){

session_start();

$_SESSION['username']=$username;

echo "<script>

alert('登入成功');

location.href='user.php';

</script>";

exit;

}else{

echo "<script>

alert('登入失败,重新登入');

location.href='denUser.php';

</script>";

exit;

}

break;

为什么条件and后面的密码查询不到？