Sqlmap: I install risk=3 --level=5 but displays extending provided level (1) and risk (1) values

[VERUMLABS777]

isk=3 --level=5 --random-agent -o --identify-waf --tamper=between,space2comment --technique=EBUS --hex --dbs --dbms="MySQL" --batch
___
__H__
___ ___["]_____ ___ ___ {1.3.5.118#dev}
|_ -| . ['] | .'| . |
|___|_ [.]_|_|_|__,| _|
|_|V... |_| http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 13:01:49 /2019-05-21/

[13:01:50] [INFO] testing connection to the target URL
[13:01:51] [WARNING] there is a DBMS error found in the HTTP response body which could interfere with the results of the tests
[13:01:51] [INFO] testing if the target URL content is stable
[13:01:52] [INFO] target URL content is stable
[13:01:52] [INFO] testing if GET parameter 'sort_key' is dynamic
[13:01:53] [WARNING] GET parameter 'sort_key' does not appear to be dynamic
[13:01:54] [INFO] heuristic (basic) test shows that GET parameter 'sort_key' might be injectable (possible DBMS: 'MySQL')
[13:01:55] [INFO] testing for SQL injection on GET parameter 'sort_key'
it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] y
for the remaining tests, do you want to include all tests for 'MySQL' extending provided level (1) and risk (1) values? [Y/n]
I install risk=3 --level=5 but displays extending provided level (1) and risk (1) values

[VERUMLABS777]

I change the injection parameter - also - flush-session does not help

[stamparm]

[stamparm]

I've used exactly the parameters you've provided and couldn't reproduce the issue

[stamparm]

If you are sure that there is an issue please give EXACT command against (e.g.) http://testphp.vulnweb.com/listproducts.php?cat=1

[VERUMLABS777]

[14:27:32] [INFO] testing for SQL injection on GET parameter 'sort_key'
it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] y
for the remaining tests, do you want to include all tests for 'MySQL' extending provided level (1) and risk (1) values? [Y/n] How do I answer forcefully ask level (3) and risk (3) ???

[stamparm]

@VERUMLABS777 how to reproduce? I can't reproduce inside testing environment. You are missing something here

[VERUMLABS777]

This problem occurs very often to me that my request has not been changed. python sqlmap.py --url "http://www.site.com/assos/formation.php3?ACTION=qualif&qualif=BNSSA" -p qualif&qualif --tamper=between --random-agent --hex --threads 5 --level=3 --risk=3 --dbs

[VERUMLABS777]

[INFO] testing for SQL injection on GET parameter 'qualif'
it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] y
for the remaining tests, do you want to include all tests for 'MySQL' extending provided level (1) and risk (1) values? [Y/n] y

[VERUMLABS777]

But I have established how you see --level=3 --risk=3

[stamparm]

For starter, you are not enclosing parameters that contain & inside (e.g. -p qualif&qualif). This causes two separate commands to be run inside the shell. THAT'S the sole reason why the part with --level=3 --risk=3 is ignored.