$username should bind as string