This is most likely a blind SQL injection, testing whether you're vulnerable to SQL Injection by checking whether your server takes the specified time or more to reply to the request. This is not actually doing any data edit nor exposing anything; it's just checking whether you're vulnerable.
It's also worth noting that this specifically targets MySQL databases, as the
sleep syntaxes are the ones of that db engine.
If the attack is isolated, you were probably "probed" by an automated vulnerability scanner that is preparing a large-scale attack, so if your webapp is not vulnerable you have nothing to worry about.
However, if you recieve more weird requests with different attack patterns, you could be the specific target of those attackers, and should take actions to prevent all attacks that may succeed.
See Time-Based Blind SQL Injection Attacks for more information.