Using prepared statements to protect against SQLI

prepared-statements.js

function authenticate(req, res, next){
    const username = req.query.username,
          password = req.query.password
    let preparedStatement = new sql.PreparedStatment(),
        sqlQuery = "select * from users where (username = @username and password = @password)"
    
    preparedStatement.input('username', sqlVarChar(50))
    preparedStatement.input('password', sqlVarChar(50))
    preparedStatement.prepare(sqlQuery)
    .then(function(){
        return preparedStatement.execute({username: username, password: password})
            .then(function(recordset){
                if(recordset.length == 1){
                    loggedIn = true
                    //successful log in
                } else {
                    //authentication failed
                }
            })
        })
    .catch(next)
}