flag5 uses a time-based sql injection. this is vulnerable to network lags. basically if the network is lagging you may end up with false positives. a correct character may take too much time to get back to sqlmap that then considers it wrong. if your flag is wrong, rerun sqlmap without the cached info, which means with --fresh-queries and/or --flush-session. good luck.