explain xkcd - User contributions [en]

1561: Water Phase Diagram

2015-08-08T02:18:59Z

StairwayToHenry:

{{comic
| number = 1561
| date = August 7, 2015
| title = Water Phase Diagram
| image = water_phase_diagram.png
| titletext = Vanilla Ice was produced in small quantities for years, but it wasn't until the 90s that experimenters collaborated to produce a sample that could survive at room temperature for several months.
}}

==Explanation==
{{incomplete| Ethion of scientific detail required.}}
[[File:WaterPhaseEdit.png|frame| The comic with a lower contrast shows [https://commons.wikimedia.org/wiki/File:Phase_diagram_of_water.svg the real phase diagram for water] from Wikipedia ]]
This is a modified version of the {{w|phase diagram}} for water. A "phase diagram" is a chart that shows the states, or "phases", that a substance will be in under various temperatures and pressures. Water's phases are particularly well-studied; on a [http://ergodic.ugr.es/termo/lecciones/water1.html real phase diagram for water], there are a great many phases listed.

Most people are familiar with three phases of water—solid, liquid, and gas—and with the fact that an increase in temperature will cause water to change from one state to another. The gas and liquid phases ("water vapor" and "liquid water") are quite straightforward; however, there is in fact not one single solid phase of water ("ice"), but a variety of numbered phases ("ice I" through "ice XV" are currently recognized), several of which are divided into sub-categories. Ordinary, everyday ice is known as "{{w|Ice Ih|ice Ih}}" ("ice one-h"). Most of the more unusual forms of ice only form under very high pressures.

Randall's phase diagram starts out realistically, though slightly simplified in several ways. For one, it simply uses the name "ice" for the usual form(s). It is focused in on a narrower area than the more complete diagram linked earlier; on that version, the "ice V" region is quite small, and "ice III" is barely visible, whereas both are quite plain to see on Randall's diagram. Lastly, Randall has the pressure scale increase downwards (which facilitates the David Bowie/Queen entry being "under" pressure), where most phase diagrams have pressure increase upwards.

As the diagram continues downwards and the pressure increases, the jokes begin. Beyond the moderately high-pressure forms of ice (ice II, III and V), a real phase diagram has ice VI; Randall has "{{w|Vanilla Ice}}", the name of a white rap/hip-hop artist from the 1990s, also having the initials "VI". Vanilla Ice's biggest hit, "{{w|Ice Ice Baby}}", used samples from the earlier song "{{w|Under Pressure}}", by {{w|David Bowie}} and {{w|Queen (band)|Queen}}; accordingly, on Randall's diagram, the "Vanilla Ice" region transitions to "David Bowie & Queen" when it is under (even higher) pressure.

Further references to "Ice Ice Baby" are found in the title text. Near the beginning of the song, Vanilla Ice raps the line, "All right stop, collaborate and listen". The unusual choice of "collaborate" in this line has made it memorable, and the word is used in the title text (in a more typical context). The phrase "survive at room temperature for several months" is likely a reference to "Ice Ice Baby" being Vanilla Ice's only major hit, humorously suggesting he faded out of the public view after a few months of fame. Finally, even the word "sample" may be deliberately chosen as a reference to the sampling of "Under Pressure".

Roman number six (VI) can be interpreted as acronym for Vanilla Ice.

Lastly, another image was faintly visible just below and to the right of the "Water Vapor" label. It appeared to be a copy of an actual phase diagram for water [https://commons.wikimedia.org/wiki/File:Phase_diagram_of_water.svg from Wikipedia]. This image could have be a reference to the "Full text of the Wikipedia article on pareidolia" joke in the [[1551: Pluto]] comic. This image could have be referred to as a ''water''mark. For some reason, Randall decided during the day to remove the watermark from the comic.

===Related comics===
Randall has referenced "Ice Ice Baby" and "Under Pressure", separately and together, on many previous occasions, notably in [[159: Boombox]]. The gag of having the performers of "Under Pressure" also being literally under pressure was also used in [[1040: Lakes and Oceans]].

The [[what if?]] that was current at the time of this comic's publication was [http://what-if.xkcd.com/138/ 138: Jupiter Submarine], which began with an even more fanciful phase diagram: that of a submarine.
It also contains a reference to the songs "Under Pressure" and "Ice Ice Baby" in one figure.

The title text of [[1434: Where Do Birds Go]] whimsically suggests another possible phase of water/ice.

The small image on the graph could be a reference to the "Full text of the Wikipedia article on pareidolia" joke in the [[1551: Pluto]] comic.

==Transcript==
:[A phase diagram is shown with eight labeled regions]

:[The horizontal axis, increasing in value to the the right is labeled:]
:Temperature

:[The vertical axis, increasing in value downwards is labeled:]
:Pressure

:[Region alongside the "Pressure" axis covering about half of its length is labeled:]
:Ice

:[Region spanning top-right corner of graph, i.e. higher temperatures and lower pressures. Below and to the right of the label there seems to be an insert of a small picture of the real phase diagram. The region is labeled:]
:Water vapor

:[Region below "Water vapor" and to the right of "Ice" is labeled:]
:Liquid water

:[Three small regions below "Ice" are going from left to right on the same pressure region, the last ending just under "Liquid water". They are each labeled:]
:Ice II
:Ice III
:Ice V

:[Region below "Ice II", "Ice III", "Ice V" and "Liquid water" is labeled:]
:Vanilla Ice
:(Ice VI)

:[Below "Vanilla Ice" there is a dashed line with two arrows pointing downwards. The region below the dashed line is labeled:]
:David Bowie & Queen

{{comic discussion}}

[[Category: Charts]]

Talk:327: Exploits of a Mom

2015-04-08T15:35:59Z

StairwayToHenry:

What about the daughter's name?[[User:Guru-45|Guru-45]] ([[User talk:Guru-45|talk]]) 14:57, 17 November 2012 (UTC)

:I think that's embellished upon later in a series called l33t. [[User:Davidy22|Davidy22]][[User talk:Davidy22|<tt>(talk)</tt>]] 15:42, 17 November 2012 (UTC)
:It's for novelty license plates with people's names on them (like "Bort" for example). [[Special:Contributions/199.27.128.67|199.27.128.67]] 18:15, 6 July 2014 (UTC)

After fixing my stupid undo I think this comic is still incomplete: What is the "driver's license factory" at the title text? --[[User:Dgbrt|Dgbrt]] ([[User talk:Dgbrt|talk]]) 16:17, 11 June 2013 (UTC)

:The common tale is that someone purchases some item or other with writing on it (or somewhere where writing can appear, on closer examination) and finds that this writing reads "Help, I'm trapped in a <item> factory", or similar, as appropriate to the object concerned. This suggests that someone is trapped (or perhaps even enslaved to work) within such a place and their only hope of escape is to make 'messages in a bottle' out of the product that leaves the facility. This is often extended to various fantastical situations, like the (British only?) joke about the stick of {{w|Rock_(confectionery)|sea-side rock}}.
:(Of course, the writing in sticks of rock generally starts to become unreadable (for normal-sized sticks) for any name larger than "Bridlington", although with care I suppose they've made them with a semi-legible "Western-super-Mare" set through them. But one aspect of this version of the joke could definitely well be that the theoretical SOS message wouldn't legibly fit.)
:So, anyway, Mrs Roberts (who waited for a number of years for Little Bobby Tables to grow up to school-age, for the illustrated exploit) is patiently waiting for her daughter to get to somewhere in her mid-teens, or later, all the while intending that she will get to spoof such a message from the local DMV's license-printing facility at some point. (Turns out that could be as 'soon' as her reaching 14-16 years of age for her first Learner license, depending on state.) Momma Roberts likes playing the long-game, it appears. [[Special:Contributions/178.98.31.27|178.98.31.27]] 16:02, 19 June 2013 (UTC)

:The mouseover text might also be a reference to an easter egg in classic Mac OS, in which the text "Help! Help! We're being held prisoner in a system software factory!" was embedded in the {{w|system suitcase}}. [[Special:Contributions/173.245.50.90|173.245.50.90]] 20:02, 13 April 2014 (UTC)

::Someone should probably put something like this on the actual page instead of just the discussion... [[Special:Contributions/173.245.56.178|173.245.56.178]] 02:23, 11 March 2015 (UTC)

Wasn't there another comic that had the digits of pi with "Help I'm trapped in a universe factory!" included in it? {{unsigned ip|108.162.249.205}}
:Yes, the earlier [[10: Pi Equals]]. [[Special:Contributions/108.162.216.83|108.162.216.83]] 20:32, 29 January 2015 (UTC)

The example talks about a SELECT query (for looking up information in a database), but I think an INSERT query (for inserting new information in the database) makes more sense, because of the closing bracket. A SELECT query is usually of the following form: SELECT column1, coulm2 FROM table WHERE username='somethingsomething'.
An INSERT query is usually of the following form: INSERT INTO table (column1, columns2) VALUES (value1, value2)
In the case of the comic, I think it's reasonable to assume it's the start of the school year and someone is adding the name of a new student (Bobby) to the database, which triggers the exploit.[[Special:Contributions/108.162.228.5|108.162.228.5]] 21:23, 23 March 2015 (UTC) David

I've made an explanation for the title text, if anyone wants to change it to make it less ambiguous or anything, edits are welcome. [[User:StairwayToHenry|StairwayToHenry]] ([[User talk:StairwayToHenry|talk]]) 15:35, 8 April 2015 (UTC)

327: Exploits of a Mom

2015-04-08T15:33:28Z

StairwayToHenry:

{{comic
| number = 327
| date = October 10, 2007
| title = Exploits of a Mom
| image = exploits_of_a_mom.png
| titletext = Her daughter is named Help I'm trapped in a driver's license factory.
}}

==Explanation==
[[Mrs. Roberts]] receives a call from her son's school. The caller, likely one of the school's administrators, asks if the she really named her son <code>Robert'); DROP TABLE Students;--</code>, a rather unusual name. Perhaps surprisingly, Mrs. Roberts responds in the affirmative, claiming that she uses the nickname "Little Bobby Tables". As the full name is read into the school's system's databases without {{w|Data sanitization#SQL injection|data sanitization}}, it causes the student table in the database to be deleted.

The title of this comic is a pun—''exploit'' can mean an accomplishment or heroic deed, but in computer science the term refers to a program or technique that takes advantage of a vulnerability in other software. In fact, one could say that her exploit is to exploit an exploit (her achievement is to make use of a vulnerability). The title can also refer to her choice of name for her son, which is rather extraordinary.

In {{w|SQL}}, a database programming language, commands are separated by semicolons <code>;</code> and strings of text are often delimited using single quotes <code>'</code>. Parts of commands may also be enclosed in parentheses <code>(</code> and <code>)</code>. Data entries are stored as "rows" within named "tables" of similar items (e.g. <code>Students</code>). The command to delete an entire table (and every row of data in that table) is <code>DROP</code>, as in <code>DROP TABLE Students;</code>).

The exploited vulnerability here is that the single quote in the name input was not correctly "escaped" by the software. That is, if a student's name did indeed contain a quote mark, it should have been parsed as one of the characters making up the text string and not as the marker to close the string, which it erroneously was. Lack of such escaping is a common SQL vulnerability; this type of exploit is referred to as {{w|SQL injection}}. Mrs. Roberts thus reminds the school to make sure they have added data filtering code to prevent code injection exploits in the future.

For example, if the site was running PHP, the code might store the student's name in a variable called <code>$name</code>, and generate an SQL statement to search the database and check that the name is valid, like this:

<code>$sql = "SELECT * FROM Students WHERE (first_name=<nowiki>'</nowiki>'''$name'''<nowiki>'</nowiki>);";</code>

For a student named "Annie", this would give the following SQL command:

<code>SELECT * FROM Students WHERE (first_name=<nowiki>'</nowiki>'''Annie'''<nowiki>'</nowiki>);</code>

which is a valid command where the 5-character string "Annie" has been substituted for "$name" in the PHP code above. However, with Mrs. Roberts' exploit, the SQL command becomes:

<code>SELECT * FROM Students WHERE (first_name=<nowiki>'</nowiki>'''Robert'); DROP TABLE Students;--'''<nowiki>'</nowiki>);</code>

As semicolons separate statements, this will be read by the interpreter as three commands:

<code>SELECT * FROM Students WHERE (first_name='Robert');</code> 
<code>DROP TABLE Students;</code> 
<code>--');</code>

The first line runs as normal, caused by the '''<code>');</code>''' punctuation in part of Little Bobby Tables' name properly closing the current command. The second injected command then does the damage, deleting the student records from the school's database. The third line begins with two hyphens <code>--</code> which are used to mark a comment in SQL, meaning that the interpreter ignores it as well as the partial fragment of code originally after <code>$name</code> in the PHP statement.

For this to work, it helps to know a little about the structure of the database. But it's quite a good guess that a school's student management database might have a table named <code>Students</code>. Mrs. Roberts' exploit also assumes that the person who wrote the code used exactly one set of parentheses around <code>(first_name='$name')</code> in the PHP example, so that the single close parenthesis in the name could match it, which apparently was a successful guess. Of course, in real life most exploits of this kind would be performed not by socially engineering a person's name such that it would eventually be entered into a database query, but rather by accessing some kind of input system (such as a website's login screen or search interface) and guessing various combinations by trial and error until something works, perhaps by first trying to inject the <code>SHOW TABLES</code> command to see how the database is structured.

The title text references that her daughter is named "Help I'm trapped in a driver's license factory". This is a play on how if someone is stuck and forced to work in a manufacturing factory/plant then they will write on the product "Help I am trapped in a ____ factory" in order to tell people on the outside. Having this name would cause any police officer that pulls her over to show some concern, as well as getting the license in the first place would be difficult.

This xkcd comic has become rather famous, spawning at least one site about preventing SQL injection named http://bobby-tables.com.

==Transcript==
:[Mrs. Roberts receives a call from her son's school.]
:Caller: Hi, This is your son's school. We're having some computer trouble.

:Mrs. Roberts: Oh, dear - did he break something?
:Caller: In a way -

:Caller: Did you really name your son <code>Robert'); DROP TABLE Students;--</code> ?
:Mrs. Roberts: Oh, yes. Little Bobby Tables, we call him.

:Caller: Well, we've lost this year's student records. I hope you're happy.
:Mrs. Roberts: And I hope you've learned to sanitize your database inputs.

{{comic discussion}}
[[Category:Comics featuring Mrs. Roberts]]
[[Category:Comics featuring Little Bobby Tables]]
[[Category:Comics featuring Elaine Roberts]]