TEST SQL Security

I have an old script using SQL query, not PDO preparing the SQL statement that is something that nowadays everybody uses to avoid SQL injection. This is my sql statement: 'SELECT `id`,`username`,`password` FROM `users` WHERE `username` = \'%s\' AND `password` = \'%s\' LIMIT 1 The user write the input on the url like this: username=mamw1&password=mamw1&moreoption=1 If it was not found the user or password, i show 404 error using http_response_code(404); The idea is to extract all the possible information on my database 10 USD anyone can inject successfully SQL to my code