Try /login.php?username=guest&password=guest.
/login.php?username=guest&password=guest
The legacy filter blocks lowercase or and literal spaces before building SQL.
or