$q = mysql_query("SELECT * FROM users WHERE user = '' OR 1=1;--' AND password = 'haslo1'");