Slashdot Mirror
Names That Break Computers (bbc.com)
Reader Thelasko writes: The BBC has a story about people with names that break computer databases. "When Jennifer Null tries to buy a plane ticket, she gets an error message on most websites. The site will say she has left the surname field blank and ask her to try again."
Thelasko compares it to the XKCD comic about Bobby Tables, though it's a real problem that's also been experienced by a Hawaiian woman named Janice Keihanaikukauakahihulihe'ekahaunaele, whose last name exceeds the 36-character limit on state ID cards. And in 2010, programmer John Graham-Cumming complained about web sites (including Yahoo) which refused to accept hyphenated last names.
Programmer Patrick McKenzie pointed the BBC to a 2011 W3C post highlighting the key issues with names, along with his own list of common mistaken assumptions. "They don't necessarily test for the edge cases," McKenzie says, noting that even when filing his own income taxes in Japan, his last name exceeds the number of characters allowed.
Have you ever seen an application (web or otherwise) that tested an input field against the value "NULL" ? Yes: test if it is NULL (note the missing quote marks) or if it is the empty string, but not the string "NULL". I can, just about, accept that some programmer high on something illegal might have done so once, but the impression given by the article is that this happens a lot.
I find this hard to believe. If it were true then the applications involved would be open to worse exploits than simple SQL injection.
Data cannot break computers. Data whose contents differ from the possible preconception of application programmers can cause errors in poorly designed, written, or tested applications.