News for hackers. Stuff that matters.
Re:Explain SQL injection without technical jargon by benesch on Thursday December 20, 2012 @08:12PM (#4950989)
How so? I thought it was brilliant. Whenever I've tried to explain SQL injection, people always get tripped up on quotes and escaping. The "blanks in a form" analogy works perfectly.
Re:Explain SQL injection without technical jargon by noahc on Thursday December 20, 2012 @08:41PM (#4951070)
Why would you explain quotes and escaping to your grandma? All you need to say is "there are special characters that when put in a certain sequence allow this to happen"
Re:Explain SQL injection without technical jargon by benesch on Thursday December 20, 2012 @09:12PM (#4951151)
I'm not talking about explaining to my grandma.

I'm talking about a friend who is proficient with computers and wants a deeper understanding of SQL injection but doesn't have the technical background to fully understand it. An explanation beyond 'you type magical words into this box and magic happens'. That's not a good explanation.

Re:Explain SQL injection without technical jargon by hadem on Friday December 21, 2012 @10:57AM (#4953123)
Saying "there are special characters that when put in a certain sequence" can be confusing for a lot of people. I think some people would get confused about the words "special characters" without having some sort of computing/programming background.

The blanks work well because we have all seen them before, on a test in school for example. It is easy for everyone to replace the blanks with the words in bold. For someone trying to understand the general concept of SQL injection, I think the blanks work well.