Gift shop — search
Filter products by category. There is a real database behind this box, and it will show you exactly what it runs.
Your goal
Break out of the intended query and read the users table. The
administrator's password is the flag — take it back to
the challenge page to submit it. Sandboxed and re-seeded every
request, so hit it as hard as you want.
Try
Gifts, then ' OR 1=1--, then a
UNION SELECT.