How does the SQL injection from the "Bobby Tables" XKCD comic work?

Asked 2008-12-01T21:50:10.220

1231

Just looking at:

What does this SQL do:

Robert'); DROP TABLE STUDENTS; --

I know both ' and -- are for comments, but doesn't the word DROP get commented as well since it is part of the same line?

security validation sql-injection

Edit Report

1 Answer

The ' character in SQL is used for string constants. In this case it is used for ending the string constant and not for comment.

answered 2008-12-01T21:54:33.613