David is working on a pen testing assignment as a junior consultant. His supervisor told him to test a web application for SQL injection. The supervisor also mentioned that some functionalities can…

David is working on a pen testing assignment as a junior consultant. His supervisor told him to test a web application for SQL injection. The supervisor also mentioned that some functionalities can lead to an unverified redirect vulnerability. David noticed that David had this string, he received a WAF error message the input is not allowed: exec_sp_addsrvrolemember 'name' , 'sysadmin'. Which of the following strings could David use instead of the above string to bypass the WAF filtering?