PHP: sleep - Manual - PHP: Hypertext Preprocessor
You should put sleep into both the pass and fail branches, since an attacker can check whether the response is slow and use that as an indicator - cutting down the delay time. But a delay in both branches eliminates this possibility....