An attacker enters ' OR '1'='1 in a login form's username field and gains access without a valid password. Which vulnerability is being exploited?

Why B is correct

SQL Injection occurs when user input is concatenated into a SQL query without parameterization. The payload ' OR '1'='1 modifies the query logic so the WHERE clause always evaluates to true, returning all records or bypassing authentication.