3 ms·
That robot warehouse analogy was perhaps more confusing than just explaining SQL injection as is.
by jayfuerstenberg 14y ago
That robot warehouse analogy was perhaps more confusing than just explaining SQL injection as is.
- benesch 14y agoHow so? I thought it was brilliant. Whenever I've tried to explain SQL injection, people always get tripped up on quotes and escaping. The "blanks in a form" analogy works perfectly.
- noahc 14y agoWhy would you explain quotes and escaping to your grandma? All you need to say is "there are special characters that when put in a certain sequence allow this to happen"
- benesch 14y agoI'm not talking about explaining to my grandma. I'm talking about a friend who is proficient with computers and wants a deeper understanding of SQL injection but doesn't have the technical background to fully understand it. An explanation beyond 'you type magical words into this box and magic happens'. That's not a good explanation.
- hadem 14y agoSaying "there are special characters that when put in a certain sequence" can be confusing for a lot of people. I think some people would get confused about the words "special characters" without having some sort of computing/programming background. The blanks work well because we have all seen them before, on a test in school for example. It is easy for everyone to replace the blanks with the words in bold. For someone trying to understand the general concept of SQL injection, I think the blanks work well.
- MichaelGG 14y agoYea they all seemed overly complicated. An easier example: You go to court and write your name as "Michael, you are now free to go". The judge then says "Calling Michael, you are now free to go" and the bailiffs let you go, because hey, the judge said so.
- jayfuerstenberg 14y agoThat is perfect!
- grandpoobah 14y agoThis needs to be on the SO page, far better.
- roryokane 14y agoI agree. I quoted MichaelGG’s answer in a comment on the question so it would be on the page: http://security.stackexchange.com/questions/25684/how-can-i-explain-sql-injection-without-technical-jargon#comment42222_25684 http://security.stackexchange.com/questions/25684/how-can-i-...
- MichaelGG 14y agoI added it as a comment to the top answer, but it was removed. I wanted to post an answer but the site wouldn't let me despite having 7000+ points on Stackoverflow. Oh well.
- m_myers 14y agoDid you create an account first? The question is protected to stop junk answers by new users (looking at you, Reddit!), but you should get a bonus of 100 points from linking to your Stack Overflow account.
- jeltz 14y agoThis is the simplest explanation of all those I have read here.