Cybersecurity glossary
What is Time-Based SQL Injection?
Learn what time-based SQL injection is, how SLEEP and WAITFOR delays leak data blindly, how attackers extract information bit by bit, and how to prevent timing-based SQLi.
Definition
Time-based SQL injection is a blind SQL injection technique in which attackers infer database information by intentionally delaying query execution—using functions such as SLEEP or WAITFOR—and measuring whether responses take longer based on true or false conditions.
Why timing becomes an oracle
When applications hide SQL errors and never reflect query results, attackers still need a signal. Time is one of the few signals left: make the database pause only when a condition is true, then measure latency.
Time-based SQL injection turns response delay into a yes/no channel for dumping data blindly.
How a time-based attack works
Confirm injectable input
Find a parameter that influences SQL without showing useful output.
Inject a conditional delay
Payloads trigger SLEEP/WAITFOR only when a boolean condition holds.
Measure response time
Slow responses mean “true”; fast responses mean “false.”
Extract data bit by bit
Binary search characters of usernames, hashes, or table contents.
Automate at scale
Tools parallelize guesses despite the inherent slowness.
Time-based vs other blind methods
| Method | Signal | Trait |
|---|---|---|
| Boolean blind | Content/status differences | Often faster than timing |
| Time-based | Latency differences | Works when content is identical |
| Out-of-band | DNS/HTTP callbacks | Needs DB network features |
Defenses and detection
Parameterize everything
Eliminate the injection so delays cannot be injected as SQL.
Least privilege
Limit what a compromised query path can read or execute.
Anomaly detection
Watch for repeated slow queries and SLEEP-like patterns.
WAF / CRS
May catch known timing payloads; do not rely on them alone.
- Use prepared statements for all untrusted inputs in SQL.
- Avoid building dynamic SQL with string concatenation.
- Alert on abnormally high query durations from web tiers.
- Disable unnecessary database features that enable delays or callbacks.
- Include blind and time-based cases in penetration tests.
- Rate-limit abusive request patterns on sensitive endpoints.
- Keep database and application error handling from leaking schema details.
- Treat any confirmed time-based SQLi as critical data-exposure risk.
The practical takeaway
Time-based SQL injection abuses query delays as a blind communication channel. If attackers can make your database sleep on command, they can usually extract data—slowly but surely.
Fix the SQL construction. Timing oracles are symptoms; parameterization is the cure.
Related security terms
SQL Injection (SQLi)
Parent injection class against SQL databases.
Blind SQL Injection
Broader blind techniques including boolean inference.
SQL Injection vulnerability guide
Splorix deep dive on SQLi exploitation and remediation.
Web Application Firewall (WAF)
May detect some timing payloads; parameterization remains primary.
Frequently asked questions
What is time-based SQL injection in simple terms?
Attackers ask the database to wait if a guess is true. If the page is slow, their guess was right—even when no data appears on screen.
When do attackers use time-based SQLi?
When the application does not return query results or useful error messages—classic blind conditions.
Which SQL functions are commonly abused?
Examples include SLEEP() (MySQL), pg_sleep() (PostgreSQL), and WAITFOR DELAY (SQL Server), among database-specific variants.
Is time-based SQLi noisy?
Yes. It is often slower and more detectable than in-band SQLi, but automation still makes large extractions practical.
How do you prevent it?
The same primary control as all SQLi: parameterized queries. Timing attacks cannot invent syntax if input cannot alter SQL structure.
Can rate limiting stop time-based SQLi?
It can slow extraction and aid detection, but it does not fix vulnerable query construction.
References
Explore authoritative guidance and frameworks related to time-based sql injection.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.