How can typing a quote mark into a login box break a website?

A quote mark can break a website because many sites build their database questions by gluing text together, and a quote mark is the character that tells the database where a piece of text ends. If a stranger's typing is glued straight into the question, the stranger gets to decide where the text stops, and anything after that point is read as instructions. This is called SQL injection.

Here is the idea without any code. A login page might ask its database something like: find the person whose name is, then it pastes in whatever you typed, then finishes the sentence. The programmer imagined you would type a name. The database cannot tell the difference between the parts the programmer wrote and the part you typed, because it receives it all as one long sentence. SQL statements mix data with commands, and that mixing is the weakness. When specially crafted input leaves the data zone and enters the command zone, the attacker can change what the question means.

The damage can be large. Attackers can pretend to be someone else, change or destroy stored data, read everything in the database, or even become administrators of the database server. In 2009 US prosecutors charged three people with stealing 130 million credit card numbers using this technique. In 2015 it was used to steal the details of 156,959 customers of the British telecom company TalkTalk through an old web page.

The cure is old and simple: never let typed text become part of the instructions. Programmers send the question and the typed value separately, using placeholders, so the database treats whatever you type purely as a value, however strange it looks. It is so well known that a famous comic made the flaw a joke, and people still call it Bobby Tables.