in your sql statement you are using 2 prepared parameters --> two '?' for nameuser and password, but you pass the real values wrong.
The db.query-function takes 2 arguments:
1. the sql query
2. an array of parameters
so you have to call it this way:this.db.query(sql, [username, password]).then....