555-1 OR 752=(SELECT 752 FROM PG_SLEEP(15))--

Short explanation (exam-friendly):

• This is a PostgreSQL time-based blind SQL injection payload.
• It tries to alter a vulnerable query by injecting: 555-1 OR (something) -- which effectively adds an OR condition to the WHERE clause and then comments out the rest of the original query.
• The core part is (SELECT 752 FROM PG_SLEEP(15)). PG_SLEEP(15) makes PostgreSQL sleep for 15 seconds. The subquery is used so that the overall condition becomes true only after that delay. If the delay happens, the attacker can infer something about the query’s logic (e.g., whether a condition is true) based on whether the response is delayed.
• The -- at the end is a SQL comment to discard any trailing original query text, ensuring the injected payload is the last thing the engine sees.

What it demonstrates:

• Time-based blind SQL injection: the attacker does not see data directly from errors but deduces information from response time.
• PostgreSQL-specific technique (pg_sleep).

Defensive takeaway (exam context and real-world practice):

• Use parameterized queries and prepared statements. Never interpolate user input directly into SQL.
• Use least-privilege database accounts for the application (no broad SUPERUSER rights).
• Validate and sanitize inputs; implement robust input handling and length checks.
• Employ a Web Application Firewall (WAF) and proper error handling (don’t leak detailed DB errors to clients).
• Consider using ORM layers or frameworks that automatically parameterize queries.
• In testing, practice on safe, isolated environments (e.g., DVWA, OWASP Juice Shop, or a local PostgreSQL instance) with explicit permission.

If you want, I can give a simple, safe example of how parameterized queries prevent this kind of injection in a specific language (e.g., Python with psycopg2, Java with JDBC).