I'm editing my question to clarify what I'm trying to ask.
In order to launch an SQL injection there should be someway to get input from the user (i.e. username and password) for instance. So I've been exposed to the attack and to the solution itself, the emphasis of the solution was on validating the input and somewhat filtering it from special characters, that was just a simple solution that basically won't be effective because if an authorised user's password contained special characters( i.e #,! etc) then that user won't be able to log into the system. My question is (although that was not the best solution) why would be filter the password's input... won't the username be enough because usually within the SQL query the username's input comes before the password's input so why filter both?
(PS I was also exposed to the parameterized queries which are better than the basic special character filter but I'd like to know what's the use of filtering the password in the first case)
From the answers and comments I got on this question, think I can make it a little more clear...what I was trying to ask is why should we filter the password in addition to filtering the username. If the filtering includes detecting special characters and the user's password contains special characters, then a valid user wont be allowed to enter they system.