Most likely, No cookie on 1st attempt, so no penalty for that
FIX VULNERABILITY: SQL Injection in COOKIE/SESSION ID