{keyword}';waitfor Delay '0:0:5'-- Apr 2026

: This is a specific T-SQL (Microsoft SQL Server) command. It instructs the database engine to pause execution for exactly 5 seconds before returning a response.

: The single quote attempts to close the string literal in the original SQL statement.

: Strict allow-listing of expected characters can prevent special symbols like ; or -- from reaching the query. {KEYWORD}';WAITFOR DELAY '0:0:5'--

: Since WAITFOR DELAY is unique to SQL Server, it confirms the specific type of database being used (e.g., MS SQL vs. MySQL). Security Risks

: Deploy a WAF to detect and block common SQL injection patterns automatically. : This is a specific T-SQL (Microsoft SQL Server) command

: In many modern systems, database errors are hidden from the user. An attacker cannot see "Success" or "Error" messages.

The payload is crafted to manipulate a database query by breaking out of the intended logic and forcing the server to pause. : Strict allow-listing of expected characters can prevent

This specific payload is used for rather than data theft. Why Use a Delay?