Consider the following code snippet

Consider the following code snippet
If(isset($_POST[‘submit’]))
{
$name=$_POST[‘name’];
$password=$_POST[‘password’];
$sql=Select * from users where name=$name and password=$password;
$data=mysqli_query($sql);
}
Why this code is a security risk and how to avoid it.