Software Engineering › Key terms › Y12 Secure Software Architecture › Sanitisation
Sanitisation
Term Key terms bank Y12 Secure Software Architecture
Definition
Cleaning input by removing or escaping dangerous characters so it cannot be run as code (for example HTML or SQL).
Example: Escape < and > so a script tag is displayed as text, not run.
Found in: syllabus, sample exam and familiarisation guidelines, school notes.
Cleaning or encoding input to neutralise dangerous characters.
Where it is used in the test
Syllabus area: Y12 Secure Software Architecture.
Question types it can appear in
- Short answer: Define, outline or explain it and tie it to the scenario.
- Multiple choice: Pick the option that matches the definition or example.
- Fill in the blanks: Choose this term to complete a statement or table.
Where it has appeared in the paper
Secure Software Architecture (Part B). Part letters follow each paper’s own layout.
Related past questions
- Sample exam Q18a (3 marks): Defensive data input handling Secure Software Architecture (Part B) · 3 marks
These are the questions the flashcard set links to this term. Open each one and compare your answer with its marking criteria.
Study links
- Flashcard: Sanitisation in Secure Software Architecture (Year 12) · study that set
- Memorise: Defensive data input handling: validation, sanitisation, error handling
- Key terms bank entry: Sanitisation
- Notes: Defensive data input handling: validation, sanitisation, error handling (Secure Software Architecture (Year 12))
- Notes: Design, develop and implement code using defensive data input handling practices,… (Secure Software Architecture (Year 12))
- Notes: Describe the benefits of developing secure software, including data protection and… (Secure Software Architecture (Year 12))
- Notes: Design, develop and implement secure code to minimise vulnerabilities in user action… (Secure Software Architecture (Year 12))
How to use it in an answer
A model sentence
“Cleaning input by removing or escaping dangerous characters so it cannot be run as code (for example HTML or SQL).” Then apply it: Escape < and > so a script tag is displayed as text, not run.
In a short answer, give the definition in your own words first, then tie it to the situation in the question. Do not copy the example above unless it fits the scenario.
Command words used with it
- Explain: Relate cause and effect; make the relationship between things evident; provide why and/or how. (Sample exam Q18a (3 marks): Defensive data input handling)
Technique for the question types
- Short answer: One clear point per mark, use the stimulus and course terms, and answer the command word.
- Multiple choice: Read all four options, rule out wrong ones, pick one; no penalty for guessing so never leave blank.
- Fill in the blanks: Choose the right word from a list; use exact syllabus terms.
What the marking guidelines and feedback say
Add server-side validation too (client-side checks can be bypassed), and use parameterised queries; the MG sample only gives the client-side answer.
Worked answers from the marking guidelines
Sample exam Q18a (3 marks): Defensive data input handling (3 marks): criteria and sample answer
Criteria
3: Explains how defensive data input handling practices can be implemented for the website. 2: Outlines some features of data input handling practices. 1: Some relevant information.
Sample answer
Data sanitisation using client-side scripting can clean the data and remove dangerous input. Input validation on the client-side can check that entered data meets all of the requirements before getting processed by the server. Errors generated by data not meeting rules can be shown to the user.
Common mistakes
- Use the term exactly as the syllabus words it, then link it to the scenario in the question; the 2025 feedback repeatedly rewards using the stimulus.
- Answer the command word: outline gives main points only, explain gives a reason or cause, discuss gives both sides.
Related terms
Same group in the syllabus: Defensive data input handling · Input validation · Error handling · Application programming interface (API) · Excessive data exposure · Memory management · Session management · Exception management