Understanding Query Strings

Have you ever wondered whether your child really came across that innappropriate image accidentally, or whether they searched it out? There is a way to find out exactly what they were searching for - by understanding a geeky term called a "query string".

Understanding query strings can help you determine how your computer is being used and what people are actively searching for. By understanding the query string, you can determine whether someone inadvertently came across some illicit content while performing an innocent search (which does happen, and is why you should always employ "safe search"), or if they were intentionally trying to locate that content.

While some web sites make an attempt to render this data unreadable to the human eye by encrypting the data into a large number or set of meaningless characters, most just use standard text formatting which permits easy interpretation. When you understand how to read this, you can understand exactly what someone has been doing on your computer; these query strings act like a trail of breadcrumbs.

A typical query string looks like this (go ahead - click on it - it is a live link to a search):

http://www.google.com/search?hl=en&q=george+washington&btnG=Google+Search

By ignoring the extraneous data encoded in this query string, one can see that someone used this computer to search for George Washington data on Google. The following version of this URL highlights the sections that provide this information.

http://www.google.com/search?hl=en&q=george+washington&btnG=Google+Search

The “www” tells us that they performed a text search (rather than an image or video search). In the query string, we see the words “George” and “Washington”, indicating what they searched for. The rest of the characters on this query string are only meaningful to the search engine and can be ignored for our purposes.

In this next example, we see that the search was slightly modified, allowing us to search for images of George Washington, rather than textual references to George Washington. Note that the "www" is replaced with "images" (this is how Google and Yahoo do it - you will notice a slightly different, yet still very readable format for ask.com and bing.com below):

http://images.google.com/images?hl=en&q=george+washington&um=1&ie=UTF-8&sa=N&tab=wi

Here are a couple of URLs showing the same searches on different search engines. See if you can pick out the relevant data to understand what search engine was used and what was being searched—that is, text or images, and what topic:

http://search.yahoo.com/search?p=george+washington&fr=yfp-t-501-s&toggle=1&cop=mss&ei=UTF-8

http://images.search.yahoo.com/search/images?p=george+washington&fr=yfp-t-501&toggle=1&cop=mss&ei=UTF-8

http://www.ask.com/web?q=george+washington&search=search&qsrc=0&o=0&l=dir

http://www.ask.com/pictures?q=george+washington&search=search&qsrc=178&o=0&l=dir

http://www.bing.com/search?q=george+washington&FORM=BWFD

http://www.bing.com/images/search?q=george+washington&FORM=BIFD#

Understanding how to interpret a query string gives you a powerful tool to help you determine if someone “just happened” to stumble across some inappropriate data, or if they were actively searching for it. This data is kept in your browser history, and it is also tracked and recorded by many of the filters available today.

Become familair with query strings, and keep a watch over what is being actively searched for on your computer. When innappropriate content is found on your computer, review the browser history and/or filter logs to see exactly what was being actively searched for when the content appeared. The best way to keep your family safe on the Internet is to keep yourself informed about the Internet!