execfile is designed to run python files only (the name is misleading).
Plus it has been removed from Python 3...
For your issue, just use subprocess.check_output, splitting the arguments properly so quoting is handled automatically (never compose your command line by yourself). Here the -p option must have the password without spaces (that's a command specificity), or use --password which is clearer
output = subprocess.check_output([r'c:\xampp\mysql\bin\mysqldump', '-h', 'localhost', '-u', username, '--password', password, database])
Note: it seems that your password is blank (empty string), in that case, just use --password= like explained here
output = subprocess.check_output([r'c:\xampp\mysql\bin\mysqldump', '-h', 'localhost', '-u', username, '--password=', database])
now the output of your command is in output (if the command succeeds), you can write it into a file (well, in your case, it's true that you'be be better off with check_call and stdout=file_handle because you seem to need the .sql file, not only the buffer) anyway:
with open("file.sql","w") as f:
f.write(output)