> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/injections/sqli/blind-based/time-based.md).

# Time Based

Time-Based SQL Injection is a type of Blind SQL Injection where the application does not return database errors or query results to the user. Instead, an attacker determines whether an injected SQL condition is true or false by observing differences in the application's response time.

This vulnerability occurs when user input is directly included in a SQL query without proper validation or parameterization. Even if the application hides errors and displays generic responses, response delays can still reveal information about the database.

***

### Vulnerable PHP Code Example

```php
<?php

$conn = mysqli_connect("localhost", "root", "password", "shop");

$id = $_GET['id'];

$query = "SELECT * FROM products WHERE id = '$id'";

$result = mysqli_query($conn, $query);

if ($row = mysqli_fetch_assoc($result)) {
    echo $row['name'];
} else {
    echo "Product not found";
}

?>
```

***

### Code Explanation

The application retrieves the `id` parameter from the URL:

```php
$id = $_GET['id'];
```

The value is then directly inserted into the SQL query:

```php
$query = "SELECT * FROM products WHERE id = '$id'";
```

Because the user input is concatenated into the query without validation or parameterization, an attacker may be able to manipulate the SQL statement.

Unlike Error-Based SQL Injection, this application does not display database errors. Instead, it returns a normal response regardless of whether the query succeeds or fails.

***

### How to Exploit

1. Identify a parameter that is used in a database query.
2. Determine whether user input influences the SQL statement.
3. Inject a condition that causes the database to delay its response when the condition evaluates to **TRUE**.
4. Measure the application's response time.
5. If the response is delayed, the condition is considered **TRUE**. If there is no delay, the condition is considered **FALSE**.
6. Repeat the process with different conditions to gradually retrieve information from the database.
7. Use the response-time differences to identify information such as the database version, database name, table names, column names, and stored data.

Because the application does not display database errors or query results, the attacker relies entirely on timing differences to infer information.