How hackers break in: the most common attacks on people, websites and apps
SQL injection: how a search box can hand a whole database to a stranger
A search box is made for product names. But on some websites, the right words in the search box give a stranger the whole customer list. Here is how SQL injection works, and how it hit TalkTalk, a big British phone company.
-
1
You want a vanilla candle, so you type "vanilla" into the search box of the shop. A second later, three candles appear. It feels as if the box just looked along the shelf.
-
2
Behind the box, the shop keeps everything it knows in one place, a database: the candles, but also every customer, with names, emails and addresses. Rono has only the search box, the same as yours. Can a box made for candle names reach the rest?
The rest of this episode is for subscribers
Subscribe to read every premium episode. You can cancel when you want.
Paid yearly: $99 instead of $119.88