This is the company in question:
https://find-and-update.company-information.service.gov.uk/c...
And a post from the person who registered it
https://pizzey.me/posts/no-i-didnt-try-to-break-companies-ho...
https://find-and-update.company-information.service.gov.uk/c...
And a post from the person who registered it
https://pizzey.me/posts/no-i-didnt-try-to-break-companies-ho...
> [..] A company has been registered [..] under the name ; DROP TABLE "COMPANIES";-- LTD, which has some computer code around it.
As the post above points out, this would either work fine or cause an error, because of the quotes -- it's not actually SQL injection.
In theory, a system could have an actual vulnerability but if it does it would mean it's also going to fail on any name with a single or double quote in it (depending on the SQL dialect). Not sure why anyone would legislate a workaround to what is essentially a "intro to databases" level programming bug.
I suspect the actual reason for it coming up in law was because of the XSS company somebody registered some time after my meme went around. That one actually did work*, and as I understand it, there was no recourse available to companies house - they are legally obliged to accurately record company names, and the law specifies which characters can be in company names, meaning you could always serve XSS there, which they're not a fan of.
That said, they forced my company name to show as 'name available on request' now (even on letters they send me, which is kind of funny), so apparently they did find a workaround.
* On third party systems consuming the data*