You are doing a code reveiw for a client and find the following SQL query used to authenticate a user:

SELECT * 
FROM users 
WHERE username = '$username' AND password = '$password';                                                    

Assume that $username and $password are user-supplied values write below a resultant SQL statement that would lead to authentication bypass and unauthorized access to the application.