TK Study
HomeMemoriseFlashcardsNotesMaster answersPast questionsMultiple choiceMock examPractice & marker

Multiple choice › Defensive data input handling

Defensive data input handling

1. Defensive data input handling

Which technique BEST protects a login form from SQL injection?

  1. Showing detailed database error messages to the user
  2. Using a larger font on the form
  3. Making the password field longer on screen
  4. Parameterised queries combined with input validation
Answer

D

Parameterised queries keep user data separate from SQL commands, and validation rejects unexpected input. Detailed error messages help attackers.

2. Defensive data input handling

What is the difference between input validation and input sanitisation?

  1. Validation happens only after the data is saved; sanitisation happens before
  2. Validation encrypts the input; sanitisation decrypts it
  3. Validation checks that input meets the rules and rejects it if not; sanitisation cleans or removes harmful characters from input
  4. They are the same process with different names
Answer

C

Validation = is this acceptable (type, range, format, length)? Sanitisation = make unsafe input safe (e.g. escape or strip < > and quotes).

3. Defensive data input handling

A program asks for an age and the user types 'abc'. Which is the BEST error-handling response?

  1. Silently set the age to 0 and continue
  2. Let the program crash so the developer sees the error
  3. Catch the error, tell the user a whole number is needed and ask again
  4. Display the full stack trace to the user
Answer

C

Good error handling anticipates bad input, gives a clear message and lets the user recover, without exposing internal details.