When the injectable parameter is the login field, you do not extract the password, you rewrite the question so the password stops mattering.

Logging in without a password

A login that builds SELECT * FROM users WHERE user='<u>' AND pass='<p>' falls to a classic payload in the username field:

admin'--