SQL injection on a club login page

A climbing club's website builds its login query by joining the text a user types into the SQL, like this:

SELECT * FROM members WHERE username = '<typed username>' AND password = '<typed password>'

An attacker types ' OR '1'='1 into both boxes and is logged in as the first member in the table.

Explain how this attack works and how the club should prevent it. [4]