"I think it's obvious that Little Bobby Tables's mom has broken the law." While this is possible, it is certainly not at all obvious.

Is it breaking the law if you do something that might cause harm to someone else who is negligent, but would not harm a similarly situated person who is duly diligent? I think not.

@phoog I think it definitely is, at least sometimes. This is why we have comparative negligence.

Does this answer your question? My child's name is "Robert'); drop table *;--" Is he in trouble?

Already asked and answered.

Obviously, no one has this specific name, but the scenario of real names causing database issues is unfortunately not uncommon

"because she obviously gave him that name with intent to harm computer systems." No. I only see the intent to make harmed computer systems obvious. If an object has a flaw, it is better to reveal that flaw so that it can be fixed than keep it hidden, or worse, not knowing about it.

@glglgl Breaking something with the intent of pointing out a flaw in that thing is still breaking it. The damage done to the system is still done and it doesn't matter that you just tried to point out an obvious problem

Special characters (aside from apostrophes and hypens) are not allowed in English names, nor is unusual capitalisation. Robert Drop Table Students would probably make it through the registrar process, but not the brackets or semi-colons.

@Richard is incorrect to say anything about English names is not allowed. A large English-speaking country, the US, has no nationwide general purpose name legislation.

@GerardAshton - English names in England, I mean. What the colonials do with the English language is their own beastly business.

@JoeW One can argue that the system is already broken and the damage is already done by the programmer.

@glglgl Again, just because programmers made mistakes in the past doesn't justify someone else taking advantage of those mistakes in order to point out those mistakes. The fact is that damaging data is a serious issue.

@JoeW this is a common problem in my country, where "D'Elia", "D'Addario", "Dell'Acqua" are hallowed surnames and yet they can (and do, and are known to do) break unsanitized SQL statements. I believe it unreasonable to require people to change their names, rather than programmers fix their code; at least for names that were already in wide use when the code was written. Moreover, Daddario is also a valid name, different from D'Addario. So entering the first to "fix" things would actually be entering false information.

@LSerni There is a difference in having a common name that is used all the time that just happens to cause issues and using a name with the intention of breaking something even if you say you are only doing to to point out the problem in the first place.

"Format C:" ? :-)

@JoeW The vulnerability is called “SQL injections”. Writing code allowing this is not a mistake, it is not negligent, it is criminally stupid. And whatever that boys name is, a hacker can type in this name instead of their own one.

@gnasher729 what distinction are you drawing between "negligent" and "criminally stupid"?

@LSerni there's also the seemingly widespread practice of writing (for example) à as a'

@gnasher729 Yes, I know it is called and how it works, I simply stated that if a user purposely takes advantage of that vulnerability and uses it on a computer system they are still liable for their actions even if they claim that they did it to show the dangers of the vulnerability. This isn't if someone has a name that could break a system and they use it without knowing rather them using it with full knowledge and intent.

@LSerni This is always relevant: Falsehoods Programmers Believe About Names

Bobby will change his name the same day that he becomes legally eligible. Because otherwise, he cannot do submit ANY online form that has one of the forty assumptions on @LSerni's link. That's most if not all, including the ridiculously huge number that don't have protection against SQL injection. My legal name violates none of those assumptions but is not accepted by most web forms. And there are sites where "exactly as shown on passport/credit card" is actually enforced when the Javascript before submission prevents that entry.

Apologies for the earlier roll back. It had targeted the incorrect revision (2 instead of 1)