SQL Injection

The -- characters you entered caused the database to ignore the rest of the SQL statement, allowing you to be authenticated without having to supply the real password.

SELECT * FROM users WHERE email = 'user@email.com' AND password = '' or 1=1--'
Logging in user user@email.com