SQL Injection Exploiting Login form

Question

I was wondering while testing my website that is there any way that the user can fetch data from my database by making some further modification in the following query

SELECT * FROM users WHERE login='admin' AND password='1' OR '1'='1';

provided that he knew admin username and used '1'='1' for password to hack into it.

What else can he add to echo the password on screen or find table details?

I want to do this to understand the limits the unprotected SQL can harm us for my presentation on SQL injection

Solution 1

Assuming that :

 ' OR '1'='1';

is a hack then possibilites might be endless if input is not sanitized eg:

' OR '1'='1'; drop table users;

ect.

Solution 2

form injection into username and password boxes should be as follows.. z' OR 'x'= 'x..... but attackers can use an url injection technique to fetch info from your website