One quote changes everything
Send a single quote as the username and watch the query fall apart:
curl -s -d "username=admin'&password=x" http://127.0.0.1:8080/app/loginIn the terminal
student@vulntech:~$ curl -s -d "username=admin'&password=x" http://127.0.0.1:8080/app/login SQL error: unrecognized token: "x'"
The server returns a SQL error. That error is gold: it proves your quote reached the database and broke the query's syntax, so the field is injectable. A careful app would never show this — and would never have let your quote through.
Common mistake: A raw error page in production is itself a finding. It confirms injection and often leaks the query, the database engine and table or column names.