The query in question probably looks something like this:
SELECT * FROM users WHERE user = '$user' AND pass = '$pass'
$pass variables are likely sanitized by either removing or escaping
'. That's why a standard attack of
' or '1'='1 or similar is not working.
With your injection, you will get the following query:
SELECT * FROM users WHERE user = '\' AND pass = '||1#'
As you are escaping the
' from the query,
user is now compared to
' and pass = (which will likely evaluate to
false, as no such user exists).
# is a comment which cuts off the rest of the query, so
||1#' evaluates to
OR true, which will be true. The authentication code will now likely fetch the first result of that query, or check if anything was returned, and thus authenticate you.