Software Engineering › Learn step by step › Y12 Secure Software Architecture
Item 233 of 426 · Year 12: Secure Software Architecture, 56 of 57
SQL injection
Term Key terms bank Check
Jump to a topic
- Exam format, question types and command words (46)
- Year 11: Programming Fundamentals (69)
- Year 11: The Object-Oriented Paradigm (33)
- Year 11: Programming Mechatronics (29)
- Year 12: Secure Software Architecture (57)
- Year 12: Programming for the Web (59)
- Year 12: Software Automation (35)
- Year 12: The Software Engineering Project (47)
- Diagrams and modelling tools (18)
- Python, SQL, pseudocode and CSS patterns (33)
Definition
An attack where malicious SQL is inserted through input so it runs on the database; stopped by parameterised queries and validation.
Example: "' OR 1=1 --" typed into a login box.
Check this one: The course specification names XSS and defensive input handling; SQL injection is the standard example the school notes use.
Found in: school notes.
Malicious SQL inserted via input; stopped by parameterised queries.
Where you'll use it in the test
Syllabus area: Y12 Secure Software Architecture.
Question types it can appear in
- Multiple choice: Pick the option that matches the definition or example.
- Short answer: Define, outline or explain it and tie it to the scenario.
- Code reading: Code or algorithm reading: interpret a fragment and state its output or purpose.
Where it has appeared in the paper
Secure Software Architecture (Part B). Part letters follow each paper’s own layout.
Related past questions
- Sample exam Q18a (3 marks): Defensive data input handling Secure Software Architecture (Part B) · 3 marks
How to use it
A model sentence
“An attack where malicious SQL is inserted through input so it runs on the database; stopped by parameterised queries and validation.” Then apply it: "' OR 1=1 --" typed into a login box.
In a short answer, give the definition in your own words first, then tie it to the situation in the question. Do not copy the example above unless it fits the scenario.
Command words used with it
- Explain: Relate cause and effect; make the relationship between things evident; provide why and/or how. (Sample exam Q18a (3 marks): Defensive data input handling)
Official worked answer
Sample exam Q18a (3 marks): Defensive data input handling (3 marks): official criteria and sample answer
Criteria
3: Explains how defensive data input handling practices can be implemented for the website. 2: Outlines some features of data input handling practices. 1: Some relevant information.
Sample answer
Data sanitisation using client-side scripting can clean the data and remove dangerous input. Input validation on the client-side can check that entered data meets all of the requirements before getting processed by the server. Errors generated by data not meeting rules can be shown to the user.
Go deeper
- Flashcard: SQL injection in Secure Software Architecture (Year 12) · study that set
- Memorise: Describe the benefits of developing secure software
- Key terms bank entry: SQL injection
- Notes: Defensive data input handling: validation, sanitisation, error handling (Secure Software Architecture (Year 12))
- Notes: Python with sqlite3 and parameterised queries (Python and SQL you must be able to write)
- Notes: Describe the benefits of developing secure software, including data protection and… (Secure Software Architecture (Year 12))
- Full term page: every question, note and marking comment for SQL injection
Check yourself
Explain “SQL injection” in one sentence, give an example, and name a question type that could test it.
Reveal the answer
An attack where malicious SQL is inserted through input so it runs on the database; stopped by parameterised queries and validation.
Example: "' OR 1=1 --" typed into a login box.
Could be tested as: Multiple choice, Short answer, Code reading.
Quick multiple choice
Which technique BEST protects a login form from SQL injection?
- Showing detailed database error messages to the user
- Using a larger font on the form
- Making the password field longer on screen
- Parameterised queries combined with input validation
Show the answer
D
Parameterised queries keep user data separate from SQL commands, and validation rejects unexpected input. Detailed error messages help attackers.
Source: original (written for this study pack; not a NESA question). Open it in the multiple-choice bank.