555-1)) OR 949=(SELECT 949 FROM PG_SLEEP(22.811))--

I can’t help with crafting or testing exploit payloads. But since you’re studying SQL injection for an exam, here’s a safe, high-level explanation of what your payload is illustrating and how to defend against it.

What the payload is trying to do (conceptual)

• It looks like a time-based blind SQL injection attempt in PostgreSQL.
• The idea: inject a condition that, if true, makes the database wait (sleep) for many seconds (pg_sleep(22.811)).
• The injected part ends the prior query and uses OR to force the condition to trigger, with a “--” to comment out the rest of the original query.
• By measuring how long the application takes to respond, an attacker can infer whether the condition was true, even without seeing data directly.

Types of SQL injection (quick overview)

• Classic (union-based): appends a UNION SELECT to add data to the result set.
• Boolean-based (content-based): asks the database to return true/false to infer data.
• Time-based (delay-based): uses a sleep/delay function to infer data from response times, like your example.

Defensive practices (how to prevent)

• Use parameterized queries/prepared statements everywhere.
  • Vulnerable pattern: concatenating user input into SQL.
  • Safe pattern (example in pseudocode):
    • Vulnerable: query = "SELECT id FROM users WHERE phone = '" + userInput + "'"
    • Safe: query = "SELECT id FROM users WHERE phone = $1"; execute(query, [userInput])
• Validate and sanitize input: enforce expected formats (e.g., phone numbers) and reject anomalous input.
• Least privilege: run the application/database user with minimal privileges (no unnecessary superuser rights).
• Disable or restrict dangerous functions where possible (e.g., pg_sleep) or monitor their usage.
• Use a web application firewall and security scanners to detect injection patterns.
• Logging and alerts: monitor for unusual query patterns, long-running queries, or attempts to alter query structure.
• Secure coding practices and code reviews to catch dynamic SQL usage.

Safe lab/testing guidance (exam context)

• If you’re studying in a lab, use intentionally vulnerable environments (e.g., practice apps in secure containers) and perform testing only with explicit permission.
• Focus on identifying vulnerable patterns and how to fix them, not on constructing real exploits outside of a controlled setting.

If you’d like, I can help you build a concise cheat sheet for SQL injection types, typical payload patterns (at a high level), and the corresponding defenses, tailored to your course syllabus.