This is the primary defense. It ensures that user input is treated as data, not as executable code [4].

If the payload works, an attacker can replace SLEEP(5) with more complex queries (e.g., IF(SUBSTRING((SELECT password FROM users),1,1)='a', SLEEP(5), 0) ) to extract data character-by-character based on whether the server pauses [3]. Security Implications

Ensure the database user account used by the web application has limited permissions.