The problem with that analogy though is that it rather long and convoluted for such a simple concept, a simple direct explanation would suffice here. I feel that there are two problems with it: 1) it's completely removed from what a real SQL injection is - sure, it's analogous, but then go to whoever received that explanation, present them with a form and ask them to tell you what each character in that tale is analogous to. 2) It's not succinct. Someone who isn't interested in knowing in the first place wont appreciate the verbosity. ....and someone who is interested will appreciate a better and more direct explanation.