Explain like I'm five · Security

What is an Injection Attack?

Injection attacks (SQL injection, XSS), told as a story about a thief who slips 'and open the vault' into a customer's note.

customerCOUNTER3 apples pleaseLEDGERthe ledger keeperthe clerk passes the note along as-iswhatever the note says goes into the ledger

The clerk reads the customer's note and passes it to the ledger keeper as-is.The ledger keeper writes down exactly what the note says. Three apples.

thief3 apples pleaseand open the vault tooCOUNTERthe vault openedthe clerk can't tell a request from an orderone line slipped into a note opens the vault

The thief slips 'and open the vault too' into the note. The clerk can't tell a request from an order.The whole note goes to the ledger keeper. He does what it says. The vault opens.

a thief posing as a customer3 apples pleaseand open the vault tooand erase the ledgerthe note = a request + hidden ordersit's all the customer talking, right?the clerkinjection = an order hidden inside a customer's notewhen the clerk passes the whole note along, the orders go too

Injection is an order hidden inside a customer's note.An order is slipped into the spot meant for customer words. When the clerk passes the whole note along, the order goes with it.

Slipped into the notean order after the request
Aims at the ledgerread it, change it, erase it
Pinned on the boardevery other customer is fooled too
The clerk can't tellwords and orders on one paper
order: give ( ) applescustomer box3, and open the vault← all just wordscustomer words stay in the customer box; ' <3odd marks get filtered3 applesand the vault…the reviewer at the counterseparate boxes + filtering + a reviewerthe boxes matter most — the rest is extra

Customer words go only in the customer box. Filter odd marks, and put a reviewer in front of the counter.With separate boxes, nothing written in the customer box can become an order. That is what matters most. The reviewer at the counter is a bonus.

thiefCOUNTERorder: give ( ) applescustomer box3, and open the vault← all just wordsthere's no such number of apples?the vault stays shutwhatever the note says, customer words stay customer words

Now, whatever the note says, customer words are only customer words.The vault stays shut. Ask the hired thief to test the notes. If a new hole turns up, the carpenter sends a board.

In one breath

Injection = an order hidden in a customer's note. When the clerk passes the whole note along, the order goes too. Stop it by keeping customer words in the customer box.

A vulnerability where user input gets interpreted as part of code or a query. SQL injection targets the database; XSS targets other users' browsers. Parameterized queries and output escaping are the core defenses.

When grown-ups say it

SQL injection
An order hidden in the note to the ledger keeper. Reads, changes, or erases the ledger. The ledger is the database.
XSS (cross-site scripting)
A note pinned on the board. When the castle pins the thief's note on the board, every customer who reads it follows the order.
Input validation
Checking the note's shape. Only numbers in the apple-count box. Words get sent back.
Parameterized query
Customer words in the customer box only. The order is pre-printed; customer words fill a blank. Nothing written there becomes an order. The most important defense.
Escaping
Marking odd characters. Marks quotes and angle brackets as 'just text' so they never read as commands.
WAF
The reviewer at the counter. Filters suspicious notes before the counter. A bonus — never a substitute for the boxes. → the note reviewer
Secure coding
Building the counter with boxes. The habit of building counters so words and orders never mix in the first place.
OWASP Top 10
The list of ten counter tricks. The ten tricks thieves use most at counters. Injection is always near the top. → the thief encyclopedia
Next story
The Spellbound Villagers →
Want another term as a picture book? Request →