Software Engineering › Key terms › Y12 Secure Software Architecture › Defensive data input handling
Defensive data input handling
Term Y12 Secure Software Architecture
Definition
Writing code that assumes input may be wrong or hostile and handles it safely using input validation, sanitisation and error handling.
Example: Reject non-numeric age, then ask again.
Found in: syllabus, sample exam and familiarisation guidelines, school notes.
Where it is used in the test
Syllabus area: Y12 Secure Software Architecture.
Question types it can appear in
- Short answer: Explain defensive data input handling (sample Q18a)
- Python: Write an input validation function
- Multiple choice: Pick the option that matches the definition or example.
Where it has appeared in the paper
Secure Software Architecture (Part A, B, C). Part letters follow each paper’s own layout.
Related past questions
- Sample exam Q18a (3 marks): Defensive data input handling Secure Software Architecture (Part B) · 3 marks
- Sample exam Q18b (3 marks): Developing secure code (Python input validation) Secure Software Architecture (Part B) · 3 marks
- Familiarisation Q9b (3 marks): Developing secure code (Python input validation) Secure Software Architecture (Part C) · 3 marks
- 2025 HSC Q19 (3 marks): Developing secure code (Python) Secure Software Architecture (Part A) · 3 marks
These are the questions the flashcard set links to this term. Open each one and compare your answer with its marking criteria.
Study links
- Flashcard: Defensive data input handling in Secure Software Architecture (Year 12) · study that set
- Memorise: Defensive data input handling: validation, sanitisation, error handling
- Master answer: sample-q18a (3 marks, short answer (explain, max 75 words)) (Master model answers: Secure Software Architecture)
- Notes: Defensive data input handling: validation, sanitisation, error handling (Secure Software Architecture (Year 12))
- Notes: Design, develop and implement code using defensive data input handling practices,… (Secure Software Architecture (Year 12))
- Notes: Part 3. Where this has been examined (see ../../question_bank.md) (Secure Software Architecture (Year 12))
How to use it in an answer
A model sentence
“Writing code that assumes input may be wrong or hostile and handles it safely using input validation, sanitisation and error handling.” Then apply it: Reject non-numeric age, then ask again.
In a short answer, give the definition in your own words first, then tie it to the situation in the question. Do not copy the example above unless it fits the scenario.
Command words used with it
- Explain: Relate cause and effect; make the relationship between things evident; provide why and/or how. (Sample exam Q18a (3 marks): Defensive data input handling)
Technique for the question types
- Short answer: One clear point per mark, use the stimulus and course terms, and answer the command word.
- Python: Write code that runs: indentation, quotes, define functions before calling them, print the required output, meet every listed requirement.
- Multiple choice: Read all four options, rule out wrong ones, pick one; no penalty for guessing so never leave blank.
What the marking guidelines and feedback say
Add server-side validation too (client-side checks can be bypassed), and use parameterised queries; the MG sample only gives the client-side answer.
Remember to call the function in the main program after defining it, e.g. print(validate_username(input('Username: '))).
Answers may include print statements to test the code, e.g. print(validateUsername("test")). The rules implied by the sample: no more than 8 characters, letters only, no '<'.
Marker feedback: process string inputs; use a selection structure; code must execute in the environment; use correct indentation; call functions in the main program after defining them.
Worked answers from the marking guidelines
Sample exam Q18a (3 marks): Defensive data input handling (3 marks): criteria and sample answer
Criteria
3: Explains how defensive data input handling practices can be implemented for the website. 2: Outlines some features of data input handling practices. 1: Some relevant information.
Sample answer
Data sanitisation using client-side scripting can clean the data and remove dangerous input. Input validation on the client-side can check that entered data meets all of the requirements before getting processed by the server. Errors generated by data not meeting rules can be shown to the user.
Sample exam Q18b (3 marks): Developing secure code (Python input validation) (3 marks): criteria and sample answer
Criteria
3: Correct function in Python to check whether a username satisfies the rules. 2: Partially correct function. 1: Some understanding of the problem and Python.
Sample answer
def validate_username(username): valid = True
# length check
if len(username) < 8:
valid = False
elif (not username[0].isupper()):
valid = False
elif (not username[-2].islower()):
valid = False
elif (not username[-1].isdigit()):
valid = False
return valid
Common mistakes
- Python questions (2025 HSC exam Q19): process string inputs; use a selection structure; code must execute in the environment; use correct indentation; call functions in the main program after defining them.
- Python questions (2025 HSC exam Q26): replicate the grid; use the random library; use selection and looping to access the list; include a method of checking the number of values; use meaningful variable names and constants; avoid overly complex structures such as nested IF loops.
- Use the term exactly as the syllabus words it, then link it to the scenario in the question; the 2025 feedback repeatedly rewards using the stimulus.
- Answer the command word: outline gives main points only, explain gives a reason or cause, discuss gives both sides.
Related terms
Same group in the syllabus: Input validation · Sanitisation · Error handling · Application programming interface (API) · Excessive data exposure · Memory management · Session management · Exception management