If the query returns a row, login succeeds.
Instead:
Here's an example payload to get you started: Sql Injection Challenge 5 Security Shepherd