Here is an approach with derived table that avoids sql injection
http://beyondrelational.com/blogs/madhivanan/archive/2010/05/14/derived-table-new-approach-to-avoid-sql-injection.aspx

Good humour!

Its simple. The name of the student which school entered in the application caused dropping of the table. Pupils name is
“Robert’);drop table students”

Good one.

Paresh

sql = ” insert into students (firstname,lastname) VALUES (‘” & field1.value & “‘, ‘” & field2.value & ‘”)”

normally, it’d be fine, where fields “bobby tables” could be:
insert into students (firstname,lastname) VALUES (‘bobby’,'tables’);

with the comic’s first name provided, which is “Robert’); DROP TABLE Students; — ”

which becomes:
insert into students (firstname,lastname) VALUES (‘Robert’); DROP TABLE Students; –’,'tables’);

in other words, the punctuation inserted causes the insert to become two statements and a comment.

in other words, insert into students, drop table students and comment out the rest.

so … as the mother of bobby tables states in the comics,

“AND I HOPE YOU’VE LEARNED TO SANITIZE YOUR DATABASE INPUTS”.

cheers.

The joke is that the parent named the child

Robert ‘);DROP TABLE Students;

And so the database input actually executed the code DROP TABLE Students.

Which the parent then is making fun of the school for not checking their data inputs.

(I have no idea how you would import such a string so that it would actually run, but I gues there must be a way)