Web - Server

The challenge request insert user "fun & profit". I added "fun & profit" by sql injection. But I didn’t retrieve the flag. Where is the mistake?

Thanks