explanation of SQL injection

I'm using the xkcd version as the example because I'm fairly certain the one in here won't actually work. It's been a while but I think most SQL servers won't accept ".
http://imgs.xkcd.com/comics/exploits_of_a_mom.png

The kid's name is ``Robert'); DROP TABLE Students;--``

Normal children have names like "Bob". Bob is a child at the school, and they have a database of all his information.

Let's say you wanted to get Bob's phone number and home address, so you can call his mom:

SELECT Name, Phone_number, Home_address FROM Students WHERE (Name='Bob')

This will give you Bob's name, phone number, and home address. Actually, it'll give you every child named Bob's details, but let's pretend he's the only Bob. If you just wanted everything stored on Bob, you could just do:

SELECT * FROM Students WHERE Name='Bob'

That's where ``SELECT *`` comes from in the image. Moe is getting all the information on the drunks in the bar.

Some other things to explain before I continue:
--This is a comment. Anything that comes after these 2 dashes will be ignored.
; can be used to separate statements. Both will be executed. e.g. ``SELECT * FROM Students WHERE Name='Bob';SELECT * FROM Students WHERE Name='Tracy'``

Now let's search for little bobby drop tables.

SELECT * FROM Students WHERE (Name='Robert'); DROP TABLE Students;--'

This command got a little weird. We use single quotes around the person's name, but the name itself has single quotes. And there's also a semicolon and comment in there!

So what happens is the SQL interpreter sees two commands:
SELECT * FROM Students WHERE (Name='Robert')
DROP TABLE Students

And there might have been some stuff after the where, but thanks to the --, all of that will be ignored.

So the SQL server will execute both of those commands. First it will get a list of all students named Robert.
Then it will "drop" the table Students. It's pretty obvious that it's bad, but to go into specifics:
All data in the student table will be removed.
The table itself will be deleted.
Which means that any further queries on student information will not only not give the info you want, but will give horrible error messages and probably crash whatever program the teachers are using.

This is known as SQL injection. Wikipedia has an article on it for more information, or if I made a mistake.

The XKCD and Simpsons examples are purely malicious. More "practical" uses would be something like

"Hey, Amazon, I'd like to search for a product. While you're at it, how about you give me every credit card number in your database?"

Competent programmers can prevent this kind of attack, so no, you won't be able to actually use this to steal cc information from amazon. Don't even try.