### Solution:
> We are taken to a simple login page. View the sources doesn't provide much info except that this is a legitamate login page.  
>
>  
>
> If we click the hint link, it takes us to a comic about a mom getting a call from her son's school about the school records being deleted because of her son. The detail that stands out is the boy's name.  
>
> `Robert'); DROP TABLE students;--`  
>
> This is what's called an injection, a string of text forces a command or script to run. The language specifically is SQL, a language used to control and manage MySQL Databases. Based on that, we know that we're going to be using SQL-Related Injections to break in. A common SQL Injection that's used on low-level-security sites is this injection. (Link:[https://www.w3schools.com/sql/sql_injection.asp]())  
>
> `' OR ''='`  
>
>  
>
> When used, this will force the SQL Command to log in as "True", which just means that it'll log in as any user that exists on the database. Let's try it out as both the username and password
>
>  
>
> It works. 
>
>  
#### **Flag:** nactf{sQllllllll_1m5qpr8x}