It drops the students table.

The original code in the school's program probably looks something like

q = "INSERT INTO Students VALUES ('" + FNMName.Text + "', '" + LName.Text + "')";

This is the naive way to add text input into a query, and is very bad, as you will see.

After the values from the first name, middle name textbox FNMName.Text (which is Robert'); DROP TABLE STUDENTS; --) and the last name textbox LName.Text (let's call it Derper) are concatenated with the rest of the query, the result is now actually two queries separated by the statement terminator (semicolon). The second query has been injected into the first. When the code executes this query against the database, it will look like this

INSERT INTO Students VALUES ('Robert'); DROP TABLE Students; --', 'Derper')

which, in plain English, roughly translates to the two queries:

Add a new record to the Students table with a Name value of 'Robert'

and

Delete the Students table

Everything past the second query is marked as a comment: --', 'Derper')

The ' in the student's name is not a comment, it's the closing string delimiter. Since the student's name is a string, it's needed syntactically to complete the hypothetical query. Injection attacks only work when the SQL query they inject results in valid SQL.

^{Edited again as per dan04's astute comment}

Let's say the name was used in a variable, $Name. You then run this query:

INSERT INTO Students VALUES ( '$Name' )

The code is mistakenly placing anything the user supplied as the variable. You wanted the SQL to be:

INSERT INTO Students VALUES ( 'Robert Tables` )

But a clever user can supply whatever they want:

INSERT INTO Students VALUES ( 'Robert'); DROP TABLE Students; --' )

What you get is:

INSERT INTO Students VALUES ( 'Robert' );  DROP TABLE STUDENTS; --' )

The -- only comments the remainder of the line.

No, ' isn't a comment in SQL, but a delimiter.

Mom supposed the database programmer made a request looking like:

INSERT INTO 'students' ('first_name', 'last_name') VALUES ('$firstName', '$lastName');

(for example) to add the new student, where the $xxx variable contents was taken directly out of an HTML form, without checking format nor escaping special characters.

So if $firstName contains Robert'); DROP TABLE students; -- the database program will execute the following request directly on the DB:

INSERT INTO 'students' ('first_name', 'last_name') VALUES ('Robert'); DROP TABLE students; --', 'XKCD');

ie. it will terminate early the insert statement, execute whatever malicious code the cracker wants, then comment out whatever remainder of code there might be.

Mmm, I am too slow, I see already 8 answers before mine in the orange band... :-) A popular topic, it seems.

Say you naively wrote a student creation method like this:

void createStudent(String name) {
    database.execute("INSERT INTO students (name) VALUES ('" + name + "')");
}

And someone enters the name Robert'); DROP TABLE STUDENTS; --

What gets run on the database is this query:

INSERT INTO students (name) VALUES ('Robert'); DROP TABLE STUDENTS --')

The semicolon ends the insert command and starts another; the -- comments out the rest of the line. The DROP TABLE command is executed...

This is why bind parameters are a good thing.

A single quote is the start and end of a string. A semicolon is the end of a statement. So if they were doing a select like this:

Select *
From Students
Where (Name = '<NameGetsInsertedHere>')

The SQL would become:

Select *
From Students
Where (Name = 'Robert'); DROP TABLE STUDENTS; --')
--             ^-------------------------------^

On some systems, the select would get ran first followed by the drop statement! The message is: DONT EMBED VALUES INTO YOUR SQL. Instead use parameters!

The '); ends the query, it doesn't start a comment. Then it drops the students table and comments the rest of the query that was supposed to be executed.

In this case, ' is not a comment character. It's used to delimit string literals. The comic artist is banking on the idea that the school in question has dynamic sql somewhere that looks something like this:

$sql = "INSERT INTO `Students` (FirstName, LastName) VALUES ('" . $fname . "', '" . $lname . "')";

So now the ' character ends the string literal before the programmer was expecting it. Combined with the ; character to end the statement, an attacker can now add (inject) whatever sql they want. The -- comment at the end is to make sure any remaining sql in the original statement does not prevent the query from compiling on the server.

FWIW, I also think the comic in question has an important detail wrong: if you sanitize your database inputs, as the comic suggests, you're still doing it wrong. Instead, you should think in terms of quarantining your database inputs, and the correct way to do this is via parameterized queries/prepared statements.

The ' character in SQL is used for string constants. In this case it is used for ending the string constant and not for comment.

The writer of the database probably did a

sql = "SELECT * FROM STUDENTS WHERE (STUDENT_NAME = '" + student_name + "') AND other stuff";
execute(sql);

If student_name is the one given, that does the selection with the name "Robert" and then drops the table. The "-- " part changes the rest of the given query into a comment.

This is how it works: Lets suppose the administrator is looking for records of student

Robert'); DROP TABLE STUDENTS; --

Since the admin account has high privileges deleting the table from this account is possible.

The code to retrieve user name from request is

Now the query would be something like this (to search the student table)

String query="Select * from student where username='"+student_name+"'";

statement.executeQuery(query); //Rest of the code follows

The resultant query becomes

Select * from student where username='Robert'); DROP TABLE STUDENTS; --

Since the user input is not sanitized, The above query has is manipulated into 2 parts

Select * from student where username='Robert'); 

DROP TABLE STUDENTS; --

The double dash (--) will just comment out remaining part of the query.

This is dangerous as it can nullify password authentication, if present

The first one will do the normal search.

The second one will drop the table student if the account has sufficient privileges (Generally the school admin account will run such query and will have the privileges talked about above).

You don't need to input form data to make SQL injection.

No one pointed this out before so through I might alert some of you.

Mostly we will try to patch forms input. But this is not the only place where you can get attacked with SQL injection. You can do very simple attack with URL which send data through GET request; Consider the fallowing example:

<a href="/show?id=1">show something</a>

Your url would look http://yoursite.com/show?id=1

Now someone could try something like this

http://yoursite.com/show?id=1;TRUNCATE table_name

Try to replace table_name with the real table name. If he get your table name right they would empty your table! (It is very easy to brut force this URL with simple script)

Your query would look something like this...

"SELECT * FROM page WHERE id = 4;TRUNCATE page"

Example of PHP vulnerable code using PDO:

<?php
...
$id = $_GET['id'];

$pdo = new PDO($database_dsn, $database_user, $database_pass);
$query = "SELECT * FROM page WHERE id = {$id}";
$stmt = $pdo->query($query);
$data = $stmt->fetch(); 
/************* You have lost your data!!! :( *************/
...

Solution - use PDO prepare() & bindParam() methods:

<?php
...
$id = $_GET['id'];

$query = 'SELECT * FROM page WHERE id = :idVal';
$stmt = $pdo->prepare($query);
$stmt->bindParam('idVal', $id, PDO::PARAM_INT);
$stmt->execute();
$data = $stmt->fetch();
/************* Your data is safe! :) *************/
...