3

(Source: https://xkcd.com/327/)

So with the upcoming birth of my first child, I suggested the name "Robert'); drop table *;--". While I was quickly told that wasn't going to happen, I have to wonder what could happen if he was actually named that.

For the less technical, this name contains what is called a SQL injection attack. If the name is entered into a poorly designed SQL system, it could potentially execute a sql command and drop all tables (i.e. cause the organization's IT manager to have a somewhat bad day, depending on how good their backups are).

So assuming I am able to get this name on his birth certificate and get his SSN assigned under that name (let us assume that the government has been able to build their system such that this name can be handled without issue), what would happen if his name fulfills its intended purpose when signing him up for day care? In that while signing little Bobby tables up for day care, his name wiped out all their data, and because of their lack of a good IT policy, they have no backups, causing no small amount of trouble for the day care.

What would I be charged with or sued for in this case?

I assume I am on the hook for some sort of malicious destruction of data or somehow liable for the loss of data.

Would this being his name afford any sort of protection? Or would the fact that it was selected intentionally to cause damage be an issue?

Jurisdiction: United States, pick any state you feel like.

  • 2
    When you're sued in court, how could you possibly make the case that the name was unintentional? How could you make the case that it wasn't intentional? – BlueDogRanch Dec 20 '19 at 17:26
  • @BlueDogRanch I will edit to clarify that the unintentional name would be something different, human readable and believable as a name, but somehow still capable of a similar effect (didn't think the technical particulars would be relevant here) – Kommissar Dec 20 '19 at 17:43
  • The "technical particulars" are everything. If you knew SQL, you'd know a similar name that may look like a real name - but not structured as an SQL command - cannot invoke an SQL command. So what is your real question? Is it "can the cartoon incident happen in real life?" That's not a legal question. – BlueDogRanch Dec 20 '19 at 18:10
  • 1
    The question is what would I be charged with or sued for as a result of the events depicted in the comic. The "unintentional" bit was a thought exercise. Removing it now as clearly its drawing attention away from the core question. – Kommissar Dec 20 '19 at 18:41
  • 2
    There actually is a similar real-life scenario that is quite common and plausible. I used to work on an application that discriminated against Irish Americans. It would crash any time a mortgage application by somebody named O'Malley came in. The Apostrophe is also the end-of-string character in SQL, and the application was very poorly written and had this problem in about 7000 places. – Kevin Keane May 10 at 2:39
4

Your kid is not in trouble; he's a minor. You're in trouble.

A criminal case for the charges a prosecutor would bring, i.e. destruction of property (the data) or for a relevant cyber or computer crime (malware, etc.), and/or a civil case for damages due to the destruction of the data would both hinge on one point: the concept of intent. See intent - Wex Legal Information Institute and Civil Law vs. Criminal Law: The Differences | Rasmussen College.

Did you knowingly intend to cause damage or data loss with the structure of the name? It's pretty clear you did. The structure of a name that can invoke an SQL command is not in any sense a standard name in spelling or format or punctuation. So how would you convince the jury or judge that you had no intent when you named your kid?

The possible poor design of a data system that didn't sanitize inputs is no defense. Saying the door was unlocked so I assume the homeowners didn't care if I trashed their house will get you laughed into jail or on the hook for a stiff civil judgement.

| improve this answer | |
  • What if the kid was named something like "null"? Real people have been named this, and it has caused problems for lots of computer systems. Arguing you had no intent with a name like "null" would be a lot easier I think. – CoffeeTableEspresso Dec 20 '19 at 20:08
  • Null is not an SQL statement, so the effects of the name Null in an input form are likely very minimal. Google "personal name null" and read the articles. No real data or system damage, so no court case or prosecution. Similar "null" inputs can be Nan, 999999, Fake, etc. – BlueDogRanch Dec 20 '19 at 21:47
  • "Your kid is not in trouble; he's a minor." More importantly, since he won't stay a minor, he didn't pick the name. – gnasher729 Dec 20 '19 at 23:11
  • Maybe when he's 18 he'll change it to Seequal Dump. – BlueDogRanch Dec 21 '19 at 3:38
1

No, your future first child would not get into trouble, since they cannot be held responsible for the initial name gave to them by another.

You, as the 'responsible' parent may be held responsible in states such as

  • Connecticut

where

not for fraudulent or nefarious purposes and does not infringe on the rights of another person,

is a condition (if if legal in one state, but used in another where it is not).


Robert'); drop table *;--

Would not be allowed in some US-States, since it contains symbols that are not allowed:

) ; *

  • Alabama, Arizona, Arkansas, Colorado, Connecticut, Georgia, Idaho
  • Kansas, Massachusetts, Michigan, Minnesota, Montana, New Jersey
  • New Mexico, New York, North Carolina, North Dakota, Ohio, Oklahoma
  • South Dakota, Texas, West Virginia

In many U.S. states, hyphens and apostrophe are the only two symbols personal names can officially contain. In some computer systems and in the machine-readable zone of a passport, they are omitted (Mary-Kate O'Neill → Mary Kate ONeill)


Sources:

| improve this answer | |
0

My child's name is “Robert'); drop table *;--” Is he in trouble?

When signing up, the name itself is unlikely to cause system --and hence legal-- issues. That is, in most cases that scenario of injection would be a non sequitur. Consider the following:

  1. Database implementations typically store first, middle, and last name in separate fields, whence the middle (or last) name starting with drop table would be surrounded by quotes (and thus, be disabled) when inserting into table(s).

  2. Tables are set up --via DDL-- so as to prevent important fields from being null (or have length equal to zero). Accordingly, code prior to the insert command ought to parse the entry so as to avoid abends from the database. Decent parsing code would catch entries for field middle_name (or last_name) which consist of a supposedly empty name '' followed by the drop command.

  3. I am not sure DDL commands accept wildcards as arguments. Of course, that could vary among RDBMSs, I haven't tried this, and I would have to start my test db (no plans to do that right now, haha).

Thus, in the event that signing up does cause a mess, the parent should conduct discovery on the implementation of the system to examine its robustness. Depending on the results of discovery, the parent could support the argument that the database was so weak that proximate or but for causation shall be ruled out. Similarly, poor design & implementation of the database is a mitigating factor, which would reduce the liability --if any-- traceable to the father's choice of name.

I started emphasizing the phrase "when signing up" because harm and liability might ensue if/when the kid's entire name is typed afterwards in other fields that are more "free format". As you surely know, there are fields of much greater length and intended for extended description, narrative, or elaboration of an event. Whereas one may expect reasonable robustness on crucial/key fields of a database table, that expectation does not necessarily hold for free-format fields. That being said, a short version of the kid's long name would most likely be used in free-format fields.

What if the name was unintentionally selected?

(Per initial version of your post ...)

That argument would be unavailing. It is just not credible that (1) a person with no background in databases would choose a name of that sort; and (2) a person with background in databases "did not know" that such last name could harm the database/catalog.

| improve this answer | |
  • drop table is not the last name. The whole thing is the given name. I do agree that its unlikely this would actually cause problems in real life though. – CoffeeTableEspresso Dec 20 '19 at 20:10
  • @CoffeeTableEspresso "The whole thing is the given name". I see. In that case I would think that at the time of data entry the clerk will very likely truncate it or split it between first name and middle name fields, given how extremely unusual it is for one single name to include multiple spaces. Truncation is likelier if the kid has a middle name in addition to such first name. – Iñaki Viggers Dec 20 '19 at 20:28
  • @CoffeeTableEspresso You might be surprised how using special names could impact you and/or your child. arstechnica.com/cars/2019/08/… – Mobius Dec 20 '19 at 20:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.