I'm a poor guy. Please buy me the secret flag.
username: poorguy
password: withnomoney
Hint: SQL Injection
Hint 2: $input_escaped = str_replace("'","\'",$user_input);