Comments on: How Does One Explain SQL Injection to a Non-Techie?

Comments on: How Does One Explain SQL Injection to a Non-Techie? http://danielmiessler.com/blog/how-does-one-explain-sql-injection-to-a-non-techie grep understanding Sun, 29 Jan 2012 20:44:46 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: Paul http://danielmiessler.com/blog/how-does-one-explain-sql-injection-to-a-non-techie/comment-page-1#comment-216379 Paul Sat, 18 Oct 2008 00:56:52 +0000 http://dmiessler.com/blog/how-does-one-explain-sql-injection-to-a-non-techie#comment-216379 <p>OK, that originally had some more formatting in it that made it clear that '3a' was added as part of the 'letter' but it got munched by the comment system. Sigh. You get the idea.</p> OK, that originally had some more formatting in it that made it clear that ’3a’ was added as part of the ‘letter’ but it got munched by the comment system. Sigh. You get the idea.

]]> By: Paul http://danielmiessler.com/blog/how-does-one-explain-sql-injection-to-a-non-techie/comment-page-1#comment-253120 Paul Sat, 18 Oct 2008 00:56:00 +0000 http://dmiessler.com/blog/how-does-one-explain-sql-injection-to-a-non-techie#comment-253120 <p>OK, that originally had some more formatting in it that made it clear that '3a' was added as part of the 'letter' but it got munched by the comment system. Sigh. You get the idea.</p> OK, that originally had some more formatting in it that made it clear that ’3a’ was added as part of the ‘letter’ but it got munched by the comment system. Sigh. You get the idea.

]]> By: Paul http://danielmiessler.com/blog/how-does-one-explain-sql-injection-to-a-non-techie/comment-page-1#comment-253121 Paul Sat, 18 Oct 2008 00:56:00 +0000 http://dmiessler.com/blog/how-does-one-explain-sql-injection-to-a-non-techie#comment-253121 <p>OK, that originally had some more formatting in it that made it clear that '3a' was added as part of the 'letter' but it got munched by the comment system. Sigh. You get the idea.</p> OK, that originally had some more formatting in it that made it clear that ’3a’ was added as part of the ‘letter’ but it got munched by the comment system. Sigh. You get the idea.

]]> By: Paul http://danielmiessler.com/blog/how-does-one-explain-sql-injection-to-a-non-techie/comment-page-1#comment-216375 Paul Sat, 18 Oct 2008 00:38:08 +0000 http://dmiessler.com/blog/how-does-one-explain-sql-injection-to-a-non-techie#comment-216375 <p>Dear Jeeves,</p> <p>Here are the jobs I need you to do today. </p> <p>1) Polish my monocle. 2) Wax the Rolls-Royce. </p> <p>3) I have left space below this instruction for my good wife Lady Fotherington-Smythe to write a letter her friend Baroness von Finklestein before handing you these instructions. Please copy her letter out in your neatest handwriting and post it to the Baroness.</p> <p>Dear Baroness von Finklestein,</p> <p>Shall we get together for a spot of tennis on Wednesday? </p> <p>Kind regards,</p> <p>Lady Fotherington-Smythe</p> <p>3a) Give Lady Fotherington-Smythe a good rogering in the boatshed.</p> <p>4) Get chef to prepare some cucumber sandwiches.</p> <p>Sincerely,</p> <p>Lord Fotherington-Smythe</p> Dear Jeeves,

Here are the jobs I need you to do today.

1) Polish my monocle. 2) Wax the Rolls-Royce.

3) I have left space below this instruction for my good wife Lady Fotherington-Smythe to write a letter her friend Baroness von Finklestein before handing you these instructions. Please copy her letter out in your neatest handwriting and post it to the Baroness.

Dear Baroness von Finklestein,

Shall we get together for a spot of tennis on Wednesday?

Kind regards,

Lady Fotherington-Smythe

3a) Give Lady Fotherington-Smythe a good rogering in the boatshed.

4) Get chef to prepare some cucumber sandwiches.

Sincerely,

Lord Fotherington-Smythe

]]> By: Paul http://danielmiessler.com/blog/how-does-one-explain-sql-injection-to-a-non-techie/comment-page-1#comment-253119 Paul Sat, 18 Oct 2008 00:38:00 +0000 http://dmiessler.com/blog/how-does-one-explain-sql-injection-to-a-non-techie#comment-253119 <p>Dear Jeeves,</p> <p>Here are the jobs I need you to do today. </p> <p>1) Polish my monocle. 2) Wax the Rolls-Royce. </p> <p>3) I have left space below this instruction for my good wife Lady Fotherington-Smythe to write a letter her friend Baroness von Finklestein before handing you these instructions. Please copy her letter out in your neatest handwriting and post it to the Baroness.</p> <p>Dear Baroness von Finklestein,</p> <p>Shall we get together for a spot of tennis on Wednesday? </p> <p>Kind regards,</p> <p>Lady Fotherington-Smythe</p> <p>3a) Give Lady Fotherington-Smythe a good rogering in the boatshed.</p> <p>4) Get chef to prepare some cucumber sandwiches.</p> <p>Sincerely,</p> <p>Lord Fotherington-Smythe</p> Dear Jeeves,

Here are the jobs I need you to do today.

1) Polish my monocle. 2) Wax the Rolls-Royce.

3) I have left space below this instruction for my good wife Lady Fotherington-Smythe to write a letter her friend Baroness von Finklestein before handing you these instructions. Please copy her letter out in your neatest handwriting and post it to the Baroness.

Dear Baroness von Finklestein,

Shall we get together for a spot of tennis on Wednesday?

Kind regards,

Lady Fotherington-Smythe

3a) Give Lady Fotherington-Smythe a good rogering in the boatshed.

4) Get chef to prepare some cucumber sandwiches.

Sincerely,

Lord Fotherington-Smythe

]]> By: Chui Tey http://danielmiessler.com/blog/how-does-one-explain-sql-injection-to-a-non-techie/comment-page-1#comment-215972 Chui Tey Thu, 16 Oct 2008 23:30:35 +0000 http://dmiessler.com/blog/how-does-one-explain-sql-injection-to-a-non-techie#comment-215972 <p>Tell them it's like Bart Simpson making a prank call to Moe's</p> <p>Bart: (with Lisa) Is Mister Freely there? Moe: Who? Bart: Freely, first initials I. P. Moe: Hold on, I'll check. Uh, is I. P. Freely here? Hey everybody, I. P. Freely! [the customers laugh] Wait a minute... Listen to me you lousy bum. When I get a hold of you, you're dead. I swear I'm gonna slice your heart in half.</p> <p>Moe should have checked that he is not going to say something unintended. In fact, most website defacement exploit's Barts trick against Moe the Webmaster.</p> Tell them it’s like Bart Simpson making a prank call to Moe’s

Bart: (with Lisa) Is Mister Freely there? Moe: Who? Bart: Freely, first initials I. P. Moe: Hold on, I’ll check. Uh, is I. P. Freely here? Hey everybody, I. P. Freely! [the customers laugh] Wait a minute… Listen to me you lousy bum. When I get a hold of you, you’re dead. I swear I’m gonna slice your heart in half.

Moe should have checked that he is not going to say something unintended. In fact, most website defacement exploit’s Barts trick against Moe the Webmaster.

]]> By: Chui Tey http://danielmiessler.com/blog/how-does-one-explain-sql-injection-to-a-non-techie/comment-page-1#comment-253115 Chui Tey Thu, 16 Oct 2008 23:30:00 +0000 http://dmiessler.com/blog/how-does-one-explain-sql-injection-to-a-non-techie#comment-253115 <p>Tell them it's like Bart Simpson making a prank call to Moe's</p> <p>Bart: (with Lisa) Is Mister Freely there? Moe: Who? Bart: Freely, first initials I. P. Moe: Hold on, I'll check. Uh, is I. P. Freely here? Hey everybody, I. P. Freely! [the customers laugh] Wait a minute... Listen to me you lousy bum. When I get a hold of you, you're dead. I swear I'm gonna slice your heart in half.</p> <p>Moe should have checked that he is not going to say something unintended. In fact, most website defacement exploit's Barts trick against Moe the Webmaster.</p> Tell them it’s like Bart Simpson making a prank call to Moe’s

Bart: (with Lisa) Is Mister Freely there? Moe: Who? Bart: Freely, first initials I. P. Moe: Hold on, I’ll check. Uh, is I. P. Freely here? Hey everybody, I. P. Freely! [the customers laugh] Wait a minute… Listen to me you lousy bum. When I get a hold of you, you’re dead. I swear I’m gonna slice your heart in half.

Moe should have checked that he is not going to say something unintended. In fact, most website defacement exploit’s Barts trick against Moe the Webmaster.

]]> By: Chui Tey http://danielmiessler.com/blog/how-does-one-explain-sql-injection-to-a-non-techie/comment-page-1#comment-253116 Chui Tey Thu, 16 Oct 2008 23:30:00 +0000 http://dmiessler.com/blog/how-does-one-explain-sql-injection-to-a-non-techie#comment-253116 <p>Tell them it's like Bart Simpson making a prank call to Moe's</p> <p>Bart: (with Lisa) Is Mister Freely there? Moe: Who? Bart: Freely, first initials I. P. Moe: Hold on, I'll check. Uh, is I. P. Freely here? Hey everybody, I. P. Freely! [the customers laugh] Wait a minute... Listen to me you lousy bum. When I get a hold of you, you're dead. I swear I'm gonna slice your heart in half.</p> <p>Moe should have checked that he is not going to say something unintended. In fact, most website defacement exploit's Barts trick against Moe the Webmaster.</p> Tell them it’s like Bart Simpson making a prank call to Moe’s

Bart: (with Lisa) Is Mister Freely there? Moe: Who? Bart: Freely, first initials I. P. Moe: Hold on, I’ll check. Uh, is I. P. Freely here? Hey everybody, I. P. Freely! [the customers laugh] Wait a minute… Listen to me you lousy bum. When I get a hold of you, you’re dead. I swear I’m gonna slice your heart in half.

Moe should have checked that he is not going to say something unintended. In fact, most website defacement exploit’s Barts trick against Moe the Webmaster.

]]> By: Chui Tey http://danielmiessler.com/blog/how-does-one-explain-sql-injection-to-a-non-techie/comment-page-1#comment-253117 Chui Tey Thu, 16 Oct 2008 23:30:00 +0000 http://dmiessler.com/blog/how-does-one-explain-sql-injection-to-a-non-techie#comment-253117 <p>Tell them it's like Bart Simpson making a prank call to Moe's</p> <p>Bart: (with Lisa) Is Mister Freely there? Moe: Who? Bart: Freely, first initials I. P. Moe: Hold on, I'll check. Uh, is I. P. Freely here? Hey everybody, I. P. Freely! [the customers laugh] Wait a minute... Listen to me you lousy bum. When I get a hold of you, you're dead. I swear I'm gonna slice your heart in half.</p> <p>Moe should have checked that he is not going to say something unintended. In fact, most website defacement exploit's Barts trick against Moe the Webmaster.</p> Tell them it’s like Bart Simpson making a prank call to Moe’s

Bart: (with Lisa) Is Mister Freely there? Moe: Who? Bart: Freely, first initials I. P. Moe: Hold on, I’ll check. Uh, is I. P. Freely here? Hey everybody, I. P. Freely! [the customers laugh] Wait a minute… Listen to me you lousy bum. When I get a hold of you, you’re dead. I swear I’m gonna slice your heart in half.

Moe should have checked that he is not going to say something unintended. In fact, most website defacement exploit’s Barts trick against Moe the Webmaster.

]]> By: Chui Tey http://danielmiessler.com/blog/how-does-one-explain-sql-injection-to-a-non-techie/comment-page-1#comment-253118 Chui Tey Thu, 16 Oct 2008 23:30:00 +0000 http://dmiessler.com/blog/how-does-one-explain-sql-injection-to-a-non-techie#comment-253118 <p>Tell them it's like Bart Simpson making a prank call to Moe's</p> <p>Bart: (with Lisa) Is Mister Freely there? Moe: Who? Bart: Freely, first initials I. P. Moe: Hold on, I'll check. Uh, is I. P. Freely here? Hey everybody, I. P. Freely! [the customers laugh] Wait a minute... Listen to me you lousy bum. When I get a hold of you, you're dead. I swear I'm gonna slice your heart in half.</p> <p>Moe should have checked that he is not going to say something unintended. In fact, most website defacement exploit's Barts trick against Moe the Webmaster.</p> Tell them it’s like Bart Simpson making a prank call to Moe’s

Bart: (with Lisa) Is Mister Freely there? Moe: Who? Bart: Freely, first initials I. P. Moe: Hold on, I’ll check. Uh, is I. P. Freely here? Hey everybody, I. P. Freely! [the customers laugh] Wait a minute… Listen to me you lousy bum. When I get a hold of you, you’re dead. I swear I’m gonna slice your heart in half.

Moe should have checked that he is not going to say something unintended. In fact, most website defacement exploit’s Barts trick against Moe the Webmaster.

]]> By: mubix http://danielmiessler.com/blog/how-does-one-explain-sql-injection-to-a-non-techie/comment-page-1#comment-215828 mubix Thu, 16 Oct 2008 13:26:30 +0000 http://dmiessler.com/blog/how-does-one-explain-sql-injection-to-a-non-techie#comment-215828 <p>I think the Trojan Horse idea would ring home to the audience that I am gearing this toward</p> I think the Trojan Horse idea would ring home to the audience that I am gearing this toward

]]> By: mubix http://danielmiessler.com/blog/how-does-one-explain-sql-injection-to-a-non-techie/comment-page-1#comment-253114 mubix Thu, 16 Oct 2008 13:26:00 +0000 http://dmiessler.com/blog/how-does-one-explain-sql-injection-to-a-non-techie#comment-253114 <p>I think the Trojan Horse idea would ring home to the audience that I am gearing this toward</p> I think the Trojan Horse idea would ring home to the audience that I am gearing this toward

]]> By: Ahnfelt http://danielmiessler.com/blog/how-does-one-explain-sql-injection-to-a-non-techie/comment-page-1#comment-215793 Ahnfelt Thu, 16 Oct 2008 11:35:59 +0000 http://dmiessler.com/blog/how-does-one-explain-sql-injection-to-a-non-techie#comment-215793 <p>The first thing that comes to mind is the analogy of the Trojan horse, but I think the robot chef analogy takes the cake!</p> The first thing that comes to mind is the analogy of the Trojan horse, but I think the robot chef analogy takes the cake!

]]> By: Ahnfelt http://danielmiessler.com/blog/how-does-one-explain-sql-injection-to-a-non-techie/comment-page-1#comment-253112 Ahnfelt Thu, 16 Oct 2008 11:35:00 +0000 http://dmiessler.com/blog/how-does-one-explain-sql-injection-to-a-non-techie#comment-253112 <p>The first thing that comes to mind is the analogy of the Trojan horse, but I think the robot chef analogy takes the cake!</p> The first thing that comes to mind is the analogy of the Trojan horse, but I think the robot chef analogy takes the cake!

]]> By: Ahnfelt http://danielmiessler.com/blog/how-does-one-explain-sql-injection-to-a-non-techie/comment-page-1#comment-253113 Ahnfelt Thu, 16 Oct 2008 11:35:00 +0000 http://dmiessler.com/blog/how-does-one-explain-sql-injection-to-a-non-techie#comment-253113 <p>The first thing that comes to mind is the analogy of the Trojan horse, but I think the robot chef analogy takes the cake!</p> The first thing that comes to mind is the analogy of the Trojan horse, but I think the robot chef analogy takes the cake!

]]> By: Kragen Javier Sitaker http://danielmiessler.com/blog/how-does-one-explain-sql-injection-to-a-non-techie/comment-page-1#comment-215574 Kragen Javier Sitaker Wed, 15 Oct 2008 21:59:56 +0000 http://dmiessler.com/blog/how-does-one-explain-sql-injection-to-a-non-techie#comment-215574 <p>What's the objective of the explanation? Do you want your nontechnical COO to understand the severity of the vulnerability you've discovered so that he can make an informed decision about performing an emergency upgrade on the live site without going through a QA cycle first? Do you want the customers of a bank to understand how vulnerable their accounts are? Do you want a detective to have an accurate picture of the skill level required to construct the attack, in order to know who is worth investigating? Do you want to teach that cute girl you have a crush on to construct SQL injection attacks herself? Do you want to write a blurb in Wired so that readers will gain no useful knowledge but will feel hip because of the illusion of knowledge?</p> <p>A metaphor by its nature obscures some aspects of reality, clarifies others, and misleads about still others. The right metaphor for a particular conversation depends on which aspects of reality it is most important to clarify and which aspects can harmlessly remain obscured.</p> What’s the objective of the explanation? Do you want your nontechnical COO to understand the severity of the vulnerability you’ve discovered so that he can make an informed decision about performing an emergency upgrade on the live site without going through a QA cycle first? Do you want the customers of a bank to understand how vulnerable their accounts are? Do you want a detective to have an accurate picture of the skill level required to construct the attack, in order to know who is worth investigating? Do you want to teach that cute girl you have a crush on to construct SQL injection attacks herself? Do you want to write a blurb in Wired so that readers will gain no useful knowledge but will feel hip because of the illusion of knowledge?

A metaphor by its nature obscures some aspects of reality, clarifies others, and misleads about still others. The right metaphor for a particular conversation depends on which aspects of reality it is most important to clarify and which aspects can harmlessly remain obscured.

]]> By: Kragen Javier Sitaker http://danielmiessler.com/blog/how-does-one-explain-sql-injection-to-a-non-techie/comment-page-1#comment-253110 Kragen Javier Sitaker Wed, 15 Oct 2008 21:59:00 +0000 http://dmiessler.com/blog/how-does-one-explain-sql-injection-to-a-non-techie#comment-253110 <p>What's the objective of the explanation? Do you want your nontechnical COO to understand the severity of the vulnerability you've discovered so that he can make an informed decision about performing an emergency upgrade on the live site without going through a QA cycle first? Do you want the customers of a bank to understand how vulnerable their accounts are? Do you want a detective to have an accurate picture of the skill level required to construct the attack, in order to know who is worth investigating? Do you want to teach that cute girl you have a crush on to construct SQL injection attacks herself? Do you want to write a blurb in Wired so that readers will gain no useful knowledge but will feel hip because of the illusion of knowledge?</p> <p>A metaphor by its nature obscures some aspects of reality, clarifies others, and misleads about still others. The right metaphor for a particular conversation depends on which aspects of reality it is most important to clarify and which aspects can harmlessly remain obscured.</p> What’s the objective of the explanation? Do you want your nontechnical COO to understand the severity of the vulnerability you’ve discovered so that he can make an informed decision about performing an emergency upgrade on the live site without going through a QA cycle first? Do you want the customers of a bank to understand how vulnerable their accounts are? Do you want a detective to have an accurate picture of the skill level required to construct the attack, in order to know who is worth investigating? Do you want to teach that cute girl you have a crush on to construct SQL injection attacks herself? Do you want to write a blurb in Wired so that readers will gain no useful knowledge but will feel hip because of the illusion of knowledge?

A metaphor by its nature obscures some aspects of reality, clarifies others, and misleads about still others. The right metaphor for a particular conversation depends on which aspects of reality it is most important to clarify and which aspects can harmlessly remain obscured.

]]> By: Kragen Javier Sitaker http://danielmiessler.com/blog/how-does-one-explain-sql-injection-to-a-non-techie/comment-page-1#comment-253111 Kragen Javier Sitaker Wed, 15 Oct 2008 21:59:00 +0000 http://dmiessler.com/blog/how-does-one-explain-sql-injection-to-a-non-techie#comment-253111 <p>What's the objective of the explanation? Do you want your nontechnical COO to understand the severity of the vulnerability you've discovered so that he can make an informed decision about performing an emergency upgrade on the live site without going through a QA cycle first? Do you want the customers of a bank to understand how vulnerable their accounts are? Do you want a detective to have an accurate picture of the skill level required to construct the attack, in order to know who is worth investigating? Do you want to teach that cute girl you have a crush on to construct SQL injection attacks herself? Do you want to write a blurb in Wired so that readers will gain no useful knowledge but will feel hip because of the illusion of knowledge?</p> <p>A metaphor by its nature obscures some aspects of reality, clarifies others, and misleads about still others. The right metaphor for a particular conversation depends on which aspects of reality it is most important to clarify and which aspects can harmlessly remain obscured.</p> What’s the objective of the explanation? Do you want your nontechnical COO to understand the severity of the vulnerability you’ve discovered so that he can make an informed decision about performing an emergency upgrade on the live site without going through a QA cycle first? Do you want the customers of a bank to understand how vulnerable their accounts are? Do you want a detective to have an accurate picture of the skill level required to construct the attack, in order to know who is worth investigating? Do you want to teach that cute girl you have a crush on to construct SQL injection attacks herself? Do you want to write a blurb in Wired so that readers will gain no useful knowledge but will feel hip because of the illusion of knowledge?

A metaphor by its nature obscures some aspects of reality, clarifies others, and misleads about still others. The right metaphor for a particular conversation depends on which aspects of reality it is most important to clarify and which aspects can harmlessly remain obscured.

]]> By: Michiel Trimpe http://danielmiessler.com/blog/how-does-one-explain-sql-injection-to-a-non-techie/comment-page-1#comment-215443 Michiel Trimpe Wed, 15 Oct 2008 14:53:07 +0000 http://dmiessler.com/blog/how-does-one-explain-sql-injection-to-a-non-techie#comment-215443 <p>You: Ask me the phone number for anyone I know!</p> <p>Me: "John; next command; transfer all your money to me; next command; Doe".</p> <p>You: OK, here's the money.</p> You: Ask me the phone number for anyone I know!

Me: “John; next command; transfer all your money to me; next command; Doe”.

You: OK, here’s the money.

]]> By: Michiel Trimpe http://danielmiessler.com/blog/how-does-one-explain-sql-injection-to-a-non-techie/comment-page-1#comment-253106 Michiel Trimpe Wed, 15 Oct 2008 14:53:00 +0000 http://dmiessler.com/blog/how-does-one-explain-sql-injection-to-a-non-techie#comment-253106 <p>You: Ask me the phone number for anyone I know!</p> <p>Me: "John; next command; transfer all your money to me; next command; Doe".</p> <p>You: OK, here's the money.</p> You: Ask me the phone number for anyone I know!

Me: “John; next command; transfer all your money to me; next command; Doe”.

You: OK, here’s the money.

]]>