.* is any characters; replace with [^"]* (any characters but quote) to not span over a quote.
Code:
sed -i 's/username="[^"]*"/username="'"$username"'"/; s/password="[^"]*"/password="'"$password"'"/' server.xml
In command arguments have $variables in quotes when the shell should not attempt substitutions on it.