For the password there's a list of them. That one doesn't always work and you can also work with the url to insert stuff to sql inject it.
But on topic, that doesn't make sense like gamechief said...