This is a hacking technique too -- I've seen it used for extracting entire databases via SQL injection by putting delays in SQL statements and then measuring ho

This is a hacking technique too -- I've seen it used for extracting entire databases via SQL injection by putting delays in SQL statements and then measuring how long the web page hangs, when you can't force any output on the page. You put different delays in for different string matches and eventually you can get all the table and column names this way.