Update SQL Injection Cheatsheet.md

Documents/SQL Injection Cheatsheet.md

@@ -171,6 +171,7 @@ Final notes!
 - `MySQL` don't have permissions to overwrite an exsisting file, make sure you go with new filename every single time with `outfile`.
 - Make sure the vulnerable paramater have false value when working with union-based SQL command injection
 - It's worth noting that all of the examples in this cheatsheet where http `GET` requests, and it shouldn't be that hard to replicate them with http `POST`requests once you grasp the core concepts.
+- You need to input true value to the vulnerable paramter for `and sleep()` to work, otherwise go with `or sleep()`
 
 To do list
 - Python or bash script to convert ascii to text after data extraction (grep output in this case)