A phone number on a big screen

The desk screen at the club is in the waiting room. It shows every member's full phone number.

A visitor reads the screen and writes the numbers down.

Nothing in the code is "broken". It does what it was told. But it is not safe. Safe code is part of good code.

Key words

Word	What it means	Example
Security risk	A way that data or a system could be harmed.	a visible phone number
Validation	Checking that input is sensible before you use it.	a name has only letters
Personal data	Facts about a real person.	name, phone number
Mask	Hide part of a value.	*******0123
Hardcoded	Typed straight into the code so anybody who reads it can see it.	password = "club123"
Character	One letter, digit (0 to 9) or sign in a text.	a, 7, !
Hashing	A one-way scramble. You cannot turn it back into the original.	sha256

The cells students fill in are left blank in this preview.

Try it: hide most of a number

Code: python

phone = "07700900123"
shown = ""
for i in range(len(phone)):
    if i < len(phone) - 4:
        shown = shown + "*"
    else:
        shown = shown + phone[i]
print(shown)

# phone[i] is the character at place i.
# Only the last 4 places are shown.
# Change the phone number and run it again.

Four common risks and fixes

Risk	Example	Fix
Bad input	A name that holds code or is 5000 letters long	Validate: check length and allowed characters
Data that everyone can see	A full phone number on a big screen	Mask it, or do not show it
Secrets in code	password = "club123" in the file	Do not hardcode. Keep secrets outside the code
Weak passwords	The password is 1234	Check the length and the kinds of character

The cells students fill in are left blank in this preview.

About hashing

data-callouts.note.label

Real systems use a special slow method and add a random extra value. A plain hash is only a first idea. Your lecturer will tell you how far to go.

Try it: a hash

Code: python

import hashlib

first = hashlib.sha256("badger2024".encode()).hexdigest()
second = hashlib.sha256("badger2025".encode()).hexdigest()
print(first)
print(second)

# One letter changes. The whole hash changes.