Function combining_mark_inject 

pub fn combining_mark_inject(payload: &str, mark: char) -> String

Inject a combining diacritical mark after each letter of payload.

s̈elect (s + U+0308 COMBINING DIAERESIS + elect) reads as select after NFC normalisation (Python unicodedata.normalize('NFC', x), Java Normalizer.normalize(s, NFC)) but the WAF regex /select/ sees a different byte sequence and misses.

Common safe marks (no NFC reflow, just stripped by char-walk readers): U+0300 grave, U+0301 acute, U+0308 diaeresis, U+0327 cedilla. U+034F COMBINING GRAPHEME JOINER is the most invisible (zero width, no visual diacritic), so it’s the default.