Exploits of a Mom
Exploits of a Mom © Randall Munroe · xkcd · CC BY-NC 2.5
Why it lands
The son's name closes the string, ends the statement, drops the Students table and comments out the rest, so a school that builds its SQL by concatenation deletes its own records. "Little Bobby Tables" became shorthand for SQL injection, and bobby-tables.com is a whole site on how to avoid it.
Transcript
- HI, THIS IS YOUR SON'S SCHOOL. WE'RE HAVING SOME COMPUTER TROUBLE.
- OH, DEAR - DID HE BREAK SOMETHING?
- IN A WAY—
- DID YOU REALLY NAME YOUR SON Robert'); DROP TABLE Students;-- ?
- OH. YES. LITTLE BOBBY TABLES, WE CALL HIM.
- WELL, WE'VE LOST THIS YEAR'S STUDENT RECORDS. I HOPE YOU'RE HAPPY.
- AND I HOPE YOU'VE LEARNED TO SANITIZE YOUR DATABASE INPUTS.
Credits
- Original
- Exploits of a Mom — Randall Munroe, xkcd
- License
- CC BY-NC 2.5
The English page shows the original image unmodified. The Japanese page shows an adaptation by wtfe²: the lettering was erased from the art and replaced with a Japanese translation. The adaptation is shared under the same license as the original.