I came across a popular webcomic about SQL injection. It shows a school database getting messed up because of a kid’s name. The comic features a kid named Robert'); DROP TABLE STUDENTS; --.
I’m trying to figure out how this actually works. I understand that the single quote and the double dash mark comments in SQL. However, doesn’t that mean the DROP portion would also be commented out since it’s on the same line?
Here’s a similar example I created to help me understand:
INSERT INTO Users (Name, Age) VALUES ('Alice'); DELETE FROM Users; --', 25);
Can someone explain how this injection functions? I’m particularly confused about where the comment begins and ends. Thanks for any insight!
yo, that comic is hilarious! but it’s also kinda scary how easy it is to mess up a database. the trick is that the name closes the first command with '); then sneaks in a new one to drop the table. the -- at the end just comments out whatever was supposed to come after. pretty clever but also dangerous AF!
The SQL injection in the ‘Little Bobby Tables’ comic works by exploiting unsanitized input. When the input ‘Robert’); DROP TABLE Students; --’ is used in a SQL query, the single quote terminates the string early, the semicolon ends the initial command, and the double dash then comments out the remainder of the intended query. This results in the DROP TABLE command being executed independently, thereby deleting the table.
From experience, using prepared statements or parameterized queries effectively separates code from input data, which is essential in preventing such vulnerabilities. Ensuring input is properly sanitized and validated is a critical security practice.
hey there! i’ve been wondering about this too. isn’t it crazy how a simple name can mess up a whole database? but i’m still confused… how does the system know where to stop reading the name? wouldn’t it just keep going until the end? anyone else have thoughts on this?
but it’s also kinda scary how easy it is to mess up a database. the trick is that the name closes the first command with 
but i’m still confused… how does the system know where to stop reading the name? wouldn’t it just keep going until the end? anyone else have thoughts on this?