SQL injection attack example

attacker deliberately input username as admin'--

select * from user where username='admin'--' and password='piggytail';
-->
select * from user where username='admin'

because -- is treated as comment/remark indicator