<p>Just looking at:</p>

<p><img src="https://i.stack.imgur.com/G0ifh.png" alt="XKCD Strip" title="Her daughter is named Help I&#39;m trapped in a driver&#39;s license factory.">
<em>(Source: <a href="https://xkcd.com/327/" rel="noreferrer">https://xkcd.com/327/</a>)</em></p>

<p>What does this SQL do:</p>

<pre><code>Robert'); DROP TABLE STUDENTS; --
</code></pre>

<p>I know both <code>'</code> and <code>--</code> are for comments, but doesn't the word <code>DROP</code> get commented as well since it is part of the same line?</p>

It drops the students table.
The original code in the school's program probably looks something like
```
```
q = "INSERT INTO Students VALUES ('" + FNMName.Text + "', '" + LName.Text + "')";
```
```
This is the naive way to add text input into a query, and is
very bad
, as you will see.
After the values from the first name, middle name textbox
FNMName.Text
(which is
```
Robert'); DROP TABLE STUDENTS; --
```
) and the last name textbox
LName.Text
(let's call it
```
Derper
```
) are concatenated with the rest of the query, the result is now actually
two queries
separated by the
statement terminator
(semicolon).  The second query has been
injected
into the first.  When the code executes this query against the database, it will look like this
```
```
INSERT INTO Students VALUES ('Robert'); DROP TABLE Students; --', 'Derper')
```
```
which, in plain English, roughly translates to the two queries:
Add a new record to the Students table with a Name value of 'Robert'
and
Delete the Students table
Everything past the second query is
marked as a comment
:
```
--', 'Derper')
```
The
```
'
```
in the student's name is not a comment, it's the closing
string delimiter
.  Since the student's name is a string, it's needed syntactically to complete the hypothetical query.  Injection attacks only work
when the SQL query they inject results in valid SQL
.
Edited
again
as per
dan04
's astute comment