john’ AND 1=1;--

At this point, if the server does not validate the user inputs properly, the server may end up executing the following SQL query:

SELECT * FROM users WHERE username = ‘john’ AND 1=1;-- AND password = ‘anything’;

Now, ‘–’ is used to indicate a comment in SQL. As a result, the condition in the SQL statement will evaluate to be true, and everything after the ‘–’ character will be discarded.

As a result, the server may end up authenticating the user john. At this point, attackers may easily exploit that to steal sensitive information from the user account of john.

This type of vulnerability is called SQL injection vulnerability. And attackers can thus use an SQL injection vulnerability to escalate privilege and access sensitive data for which the attacker is not authorized.

Hence, it is crucial for servers to validate a user input properly before the user input is included in an SQL query. As I said, characters like <, >, –, ‘, “, etc. should always be escaped properly.

Interested readers may find more information here: What is an SQL injection attack?