I once read a story on Reddit about a payroll processor with an utterly unholy mess of a system. One day, they get a customer called "Select", and the entire system stopped working.

This isn't SQL, but HP printers' settings protocol uses XML and doesn't escape Wi-Fi SSIDs, so it breaks completely whenever any nearby SSID includes < or >. Which wouldn't be a massive problem, except for that Com Hem (our Comcast) has set their default SSID to COMHEM<(start of router MAC)>.

What do you mean by "IRL" ? SQL injections work every day, I think it's still the number one in the OWASP top 10.

There's the stories of people named Null that make various systems crash or reject them, probably because they coerce to strings before checking for a "null" value.

Not SQL but I once set my Wifi hotspot to "NULL" in the lecture hall and someone started complaining that their phone was crashing constantly.

The sheer number of devices that have these kinds of vulnerabilities is simply insane.

My wifi name is a drop_table NETWORKS injection. Never heard of it affecting anything though.