(Source: https://xkcd.com/327/)

So with the upcoming birth of my first child, I suggested the name "Robert'); drop table *;--". While I was quickly told that wasn't going to happen, I have to wonder what could happen if he was actually named that.

For the less technical, this name contains what is called a SQL injection attack. If the name is entered into a poorly designed SQL system, it could potentially execute a sql command and drop all tables (i.e. cause the organization's IT manager to have a somewhat bad day, depending on how good their backups are).

So assuming I am able to get this name on his birth certificate and get his SSN assigned under that name (let us assume that the government has been able to build their system such that this name can be handled without issue), what would happen if his name fulfills its intended purpose when signing him up for day care? In that while signing little Bobby tables up for day care, his name wiped out all their data, and because of their lack of a good IT policy, they have no backups, causing no small amount of trouble for the day care.

What would I be charged with or sued for in this case?

I assume I am on the hook for some sort of malicious destruction of data or somehow liable for the loss of data.

Would this being his name afford any sort of protection? Or would the fact that it was selected intentionally to cause damage be an issue?

Jurisdiction: United States, pick any state you feel like.

  • 5
    When you're sued in court, how could you possibly make the case that the name was unintentional? How could you make the case that it wasn't intentional? Commented Dec 20, 2019 at 17:26
  • 2
    @BlueDogRanch I will edit to clarify that the unintentional name would be something different, human readable and believable as a name, but somehow still capable of a similar effect (didn't think the technical particulars would be relevant here)
    – Kommissar
    Commented Dec 20, 2019 at 17:43
  • 2
    The "technical particulars" are everything. If you knew SQL, you'd know a similar name that may look like a real name - but not structured as an SQL command - cannot invoke an SQL command. So what is your real question? Is it "can the cartoon incident happen in real life?" That's not a legal question. Commented Dec 20, 2019 at 18:10
  • 4
    The question is what would I be charged with or sued for as a result of the events depicted in the comic. The "unintentional" bit was a thought exercise. Removing it now as clearly its drawing attention away from the core question.
    – Kommissar
    Commented Dec 20, 2019 at 18:41
  • 10
    There actually is a similar real-life scenario that is quite common and plausible. I used to work on an application that discriminated against Irish Americans. It would crash any time a mortgage application by somebody named O'Malley came in. The Apostrophe is also the end-of-string character in SQL, and the application was very poorly written and had this problem in about 7000 places. Commented May 10, 2020 at 2:39

4 Answers 4


Your kid is not in trouble; he's a minor. You're in trouble.

A criminal case for the charges a prosecutor would bring, i.e. destruction of property (the data) or for a relevant cyber or computer crime (malware, etc.), and/or a civil case for damages due to the destruction of the data would both hinge on one point: the concept of intent. See intent - Wex Legal Information Institute and Civil Law vs. Criminal Law: The Differences | Rasmussen College.

Did you knowingly intend to cause damage or data loss with the structure of the name? It's pretty clear you did. The structure of a name that can invoke an SQL command is not in any sense a standard name in spelling or format or punctuation. So how would you convince the jury or judge that you had no intent when you named your kid?

The possible poor design of a data system that didn't sanitize inputs is no defense. Saying the door was unlocked so I assume the homeowners didn't care if I trashed their house will get you laughed into jail or on the hook for a stiff civil judgement.

  • 1
    What if the kid was named something like "null"? Real people have been named this, and it has caused problems for lots of computer systems. Arguing you had no intent with a name like "null" would be a lot easier I think. Commented Dec 20, 2019 at 20:08
  • Null is not an SQL statement, so the effects of the name Null in an input form are likely very minimal. Google "personal name null" and read the articles. No real data or system damage, so no court case or prosecution. Similar "null" inputs can be Nan, 999999, Fake, etc. Commented Dec 20, 2019 at 21:47
  • 4
    "Your kid is not in trouble; he's a minor." More importantly, since he won't stay a minor, he didn't pick the name.
    – gnasher729
    Commented Dec 20, 2019 at 23:11
  • Maybe when he's 18 he'll change it to Seequal Dump. Commented Dec 21, 2019 at 3:38
  • 3
    "The structure of a name that can invoke an SQL command is not in any sense a standard name in spelling or format or punctuation." How about Timmy O'or't'is't? It's unusual to have four apostrophes in one name, but some languages do have more apostrophes when transliterated to the Latin alphabet. Even if it looks non-standard, it's not outside the bounds of plausibility.
    – kaya3
    Commented Jan 5 at 17:37

No, your future first child would not get into trouble, since they cannot be held responsible for the initial name gave to them by another.

You, as the 'responsible' parent may be held responsible in states such as

  • Connecticut


not for fraudulent or nefarious purposes and does not infringe on the rights of another person,

is a condition (if if legal in one state, but used in another where it is not).

Robert'); drop table *;--

Would not be allowed in some US-States, since it contains symbols that are not allowed:

) ; *

  • Alabama, Arizona, Arkansas, Colorado, Connecticut, Georgia, Idaho
  • Kansas, Massachusetts, Michigan, Minnesota, Montana, New Jersey
  • New Mexico, New York, North Carolina, North Dakota, Ohio, Oklahoma
  • South Dakota, Texas, West Virginia

In many U.S. states, hyphens and apostrophe are the only two symbols personal names can officially contain. In some computer systems and in the machine-readable zone of a passport, they are omitted (Mary-Kate O'Neill → Mary Kate ONeill)



My child's name is “Robert'); drop table *;--” Is he in trouble?

When signing up, the name itself is unlikely to cause system --and hence legal-- issues. That is, in most cases that scenario of injection would be a non sequitur. Consider the following:

  1. Database implementations typically store first, middle, and last name in separate fields, whence the middle (or last) name starting with drop table would be surrounded by quotes (and thus, be disabled) when inserting into table(s).

  2. Tables are set up --via DDL-- so as to prevent important fields from being null (or have length equal to zero). Accordingly, code prior to the insert command ought to parse the entry so as to avoid abends from the database. Decent parsing code would catch entries for field middle_name (or last_name) which consist of a supposedly empty name '' followed by the drop command.

  3. I am not sure DDL commands accept wildcards as arguments. Of course, that could vary among RDBMSs, I haven't tried this, and I would have to start my test db (no plans to do that right now, haha).

Thus, in the event that signing up does cause a mess, the parent should conduct discovery on the implementation of the system to examine its robustness. Depending on the results of discovery, the parent could support the argument that the database was so weak that proximate or but for causation shall be ruled out. Similarly, poor design & implementation of the database is a mitigating factor, which would reduce the liability --if any-- traceable to the father's choice of name.

I started emphasizing the phrase "when signing up" because harm and liability might ensue if/when the kid's entire name is typed afterwards in other fields that are more "free format". As you surely know, there are fields of much greater length and intended for extended description, narrative, or elaboration of an event. Whereas one may expect reasonable robustness on crucial/key fields of a database table, that expectation does not necessarily hold for free-format fields. That being said, a short version of the kid's long name would most likely be used in free-format fields.

What if the name was unintentionally selected?

(Per initial version of your post ...)

That argument would be unavailing. It is just not credible that (1) a person with no background in databases would choose a name of that sort; and (2) a person with background in databases "did not know" that such last name could harm the database/catalog.

  • 1
    drop table is not the last name. The whole thing is the given name. I do agree that its unlikely this would actually cause problems in real life though. Commented Dec 20, 2019 at 20:10
  • 1
    @CoffeeTableEspresso "The whole thing is the given name". I see. In that case I would think that at the time of data entry the clerk will very likely truncate it or split it between first name and middle name fields, given how extremely unusual it is for one single name to include multiple spaces. Truncation is likelier if the kid has a middle name in addition to such first name. Commented Dec 20, 2019 at 20:28
  • 1
    @CoffeeTableEspresso You might be surprised how using special names could impact you and/or your child. arstechnica.com/cars/2019/08/…
    – Mobius
    Commented Dec 20, 2019 at 20:45
  • 2
    The whole point of the joke is that some people used to write SQL statements with string concatenation. The idea is to encourage good practices like you mention.
    – User65535
    Commented Jun 3, 2023 at 8:58

That string of characters is not acceptable as a name in some jurisdictions in the first place.

will block the name on the basis that the name is on one hand prone to damaging the child, and on the other hand is unprintable by the Bundesdruckerei. Insted, your child will only be registered as the closest equivalent, Robert Drop Table.

will block the name, because it does not use Hiragana, Katakana or approved kanji. The closest would be the phonetic ロバート ドロップ テーブル (Robāto doroppu tēburu) or, using the proper words for drop and spreadhseet ロバート 落とす 表計算 (Robāto Otosu Omotekeisan)

  • @Stef fixed the error
    – Trish
    Commented Jan 5 at 16:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .