What is a query string?
A query string is a representation that a web browser needs to send data to a server.
Query strings are also called “query strings” or “URL parameters”.
Even if you have never heard of the term query string, if there is a “?” symbol in the middle of the displayed URL, the string after the “?” is the query string.
For example, if you search for a book containing the keyword “project” from the collection of the National Diet Library, the URL of the search result screen will be as follows.
https://trendbuk.com/#!/search?lang=en&keyword=project&searchCode=SIMPLE
If you look at this URL, you can see that words such as “lang (language)” and “keyword (keyword)” are included behind the search and have some influence on search results.
As you can see from this National Diet Library URL, the query string is usually written at the end of the URL, preceded by a “?”. After that, describe the contents in the format of “variable name = value”, and if there are multiple variables or values, use “&” as a separator.
By using this query string, it is possible to change the display contents of the web page and perform an accurate access analysis.
Query string type
Query string type 1: passive parameters
There are two types of query strings. One of them is the “passive parameter”.
Passive parameters are mostly used in the web advertising genre.
Passive parameters are query strings that do not affect how content is displayed. It is sometimes called a “dummy parameter”
because the page does not change.
More detailed access analysis is possible by adding passive parameters to the URL of the web browser.
For example, it is possible to measure which media the user came from, and if the user did not come from a web browser, from what kind of content such as an email magazine, smartphone application, QR code, etc.
Furthermore, if you have multiple ads on the page, you can find out exactly where the user clicked on the ad.
Query string type 2: active parameters
Another query string is the “active parameter”.
This is in contrast to “passive parameters”, which can change the content being displayed.
For example, on a shopping site, active parameters are used to sort products by price, popularity, etc., or to filter by type.
Query String Precautions/Information Leakage
Query strings are a publisher-friendly technique, but they are not suitable for passing sensitive information.
The URL is also accessible to users.
Therefore, if a malicious user rewrites the value, it may impersonate another user or leak user information.
In this way, the query string is easily exposed to the outside, so it can be said that care must be taken in managing the information.
