Questions 5 and 6 require the use of SQL injection. This is a process of trial and error. The difficulty with SQL injections is that the attacker does not control the entirety of the SQL statement because the input provided via the search bar is being added into a section of the SQL statement. This means that the SQL injection itself will not be a valid SQL statement - the combination of the existing SQL statement, plus the SQL injection will need to be a valid SQL statement. This means the SQL injection must be carefully crafted so that the final SQL statement is valid. In the case of this challenge, the SQL statement being executed is: