I'm struggling to understand. I can understand how a timing attack would reveal enough details to differentiate between data being touched (but not expected to

I'm struggling to understand. I can understand how a timing attack would reveal enough details to differentiate between data being touched (but not expected to be returned). But I can't understand how this would cause SQL injection... do you mean it's a way to perform unauthorized queries, or do you mean data-altering statements could also be executed?