SQLi 00: Login Bypass

• The application concatenates both username and password into one SQL query.
• Try turning the WHERE clause into something always true.
• The role check only happens after the query already returned a row.

When user input is appended directly into SQL, attackers can change boolean logic in the WHERE clause and bypass authentication.