How so? I thought it was brilliant. Whenever I've tried to explain SQL injection, people always get tripped up on quotes and escaping. The "blanks in a form" analogy works perfectly.
Why would you explain quotes and escaping to your grandma? All you need to say is "there are special characters that when put in a certain sequence allow this to happen"
I'm talking about a friend who is proficient with computers and wants a deeper understanding of SQL injection but doesn't have the technical background to fully understand it. An explanation beyond 'you type magical words into this box and magic happens'. That's not a good explanation.
Saying "there are special characters that when put in a certain sequence" can be confusing for a lot of people. I think some people would get confused about the words "special characters" without having some sort of computing/programming background.
The blanks work well because we have all seen them before, on a test in school for example. It is easy for everyone to replace the blanks with the words in bold. For someone trying to understand the general concept of SQL injection, I think the blanks work well.
