Is the following PHP code vulnerable to XSS attacks, and why? Rewrite this code to prevent XSS attacks

$servername = "localhost";

$username = "me";

$password = "!myPa$$";

$dbname = "mydb";

if(isset($_POST["uname"], $_POST["upass"])) {

$conn = new mysqli($servername, $username, $password, $dbname);

if (!$conn->connect_error) {

die("Connection failed: " . $conn->connect_error);

}

$query = "select * from user where uname='$_POST[uname]' AND upass='$_POST[upass]'";

$result = $conn->query($query);

}

?>