Vulnerable Web App

Hello, I need a vulnerable web app modifications. I have done everyting, but i just need to fix the SQL challenge part. I supposed to type in a SQL script/Command instead of using firstname to fetch surname. I just to fix this part to allow users to type in a basic SQL command to retrive surame instead of typing in the firstname directly.

SELECT firtsnam Where …

instead of firstname.

I have also attach the work I have done. Just fix only the sql challenge and styling.