Why Your Name Can Break A Website
If a website glues your name straight into its database question, one apostrophe ends the question early and the rest is read as a command.
The script
A name with one apostrophe in it can delete a whole database.
Not a hack. Just a name, typed into a form.
Old websites glue your text straight into the database question.
The apostrophe in your name ends the question early. Everything after it is a command.
So a name like Robert, quote, bracket, semicolon, drop table students... deletes the students.
In twenty fifteen, one injection like this exposed a hundred and fifty seven thousand TalkTalk customers.
The fix is boring. Keep the code and the data apart.
Then your name is only ever a name.
So the next time a form rejects your name...
The facts, checked
- SQL injection happens when untrusted input is concatenated into a query: the apostrophe closes the string literal and the remainder is parsed as SQL.
- xkcd 327, "Exploits of a Mom" (the "Little Bobby Tables" joke), popularised the name Robert'); DROP TABLE Students;-- as the canonical example.
- TalkTalk's October 2015 breach came from SQL injection in a web page and affected about 156,959 customers; the ICO fined the company £400,000 in 2016.
- Parameterised queries / prepared statements send the SQL code and the data separately, so input can never be parsed as a command.
