just type the sql injection into the url bar, e.g. copy this:

javascript:alert(\"hello\")

i found basic 5 quite hard aswell. Well basically, remember basic four, you changed the \'to\' value to another email, in this case, it won\'t let you. I won\'t go into details now, but basically, you have to change \'to\' value on the webopage itself. To do this you have to use javascript injections. There are two main ones, \'alert\' and \'void\'. Try this out by typing in to the browser (where you enter the website adress): \'javascript:alert(\"hello!\")\'. The syntax for void is:
\'Javascript:void(document.forms[x].[name of field].value=\"anything\")\'. In our case, x is the form on the page, so if there are 4 forms ont the page, x would be 3. Obviosly name of the field is literally, the name of the field, so it is \'to\'