Software Engineering › Key terms › Y12 Secure Software Architecture › SQL injection
SQL injection
Term Key terms bank Check Y12 Secure Software Architecture
Definition
An attack where malicious SQL is inserted through input so it runs on the database; stopped by parameterised queries and validation.
Example: "' OR 1=1 --" typed into a login box.
Check this one: The course specification names XSS and defensive input handling; SQL injection is the standard example the school notes use.
Found in: school notes.
Malicious SQL inserted via input; stopped by parameterised queries.
Where it is used in the test
Syllabus area: Y12 Secure Software Architecture.
Question types it can appear in
- Multiple choice: Pick the option that matches the definition or example.
- Short answer: Define, outline or explain it and tie it to the scenario.
- Code reading: Code or algorithm reading: interpret a fragment and state its output or purpose.
Where it has appeared in the paper
Secure Software Architecture (Part B). Part letters follow each paper’s own layout.
Related past questions
- Sample exam Q18a (3 marks): Defensive data input handling Secure Software Architecture (Part B) · 3 marks
These are the questions the flashcard set links to this term. Open each one and compare your answer with its marking criteria.
Study links
- Flashcard: SQL injection in Secure Software Architecture (Year 12) · study that set
- Memorise: Describe the benefits of developing secure software
- Key terms bank entry: SQL injection
- Notes: Defensive data input handling: validation, sanitisation, error handling (Secure Software Architecture (Year 12))
- Notes: Python with sqlite3 and parameterised queries (Python and SQL you must be able to write)
- Notes: Describe the benefits of developing secure software, including data protection and… (Secure Software Architecture (Year 12))
- Notes: Secure Python: validation and parameterised SQL (Python and SQL you must be able to write)
How to use it in an answer
A model sentence
“An attack where malicious SQL is inserted through input so it runs on the database; stopped by parameterised queries and validation.” Then apply it: "' OR 1=1 --" typed into a login box.
In a short answer, give the definition in your own words first, then tie it to the situation in the question. Do not copy the example above unless it fits the scenario.
Command words used with it
- Explain: Relate cause and effect; make the relationship between things evident; provide why and/or how. (Sample exam Q18a (3 marks): Defensive data input handling)
Technique for the question types
- Multiple choice: Read all four options, rule out wrong ones, pick one; no penalty for guessing so never leave blank.
- Short answer: One clear point per mark, use the stimulus and course terms, and answer the command word.
What the marking guidelines and feedback say
Add server-side validation too (client-side checks can be bypassed), and use parameterised queries; the MG sample only gives the client-side answer.
Worked answers from the marking guidelines
Sample exam Q18a (3 marks): Defensive data input handling (3 marks): criteria and sample answer
Criteria
3: Explains how defensive data input handling practices can be implemented for the website. 2: Outlines some features of data input handling practices. 1: Some relevant information.
Sample answer
Data sanitisation using client-side scripting can clean the data and remove dangerous input. Input validation on the client-side can check that entered data meets all of the requirements before getting processed by the server. Errors generated by data not meeting rules can be shown to the user.
Common mistakes
- Check the sources: The course specification names XSS and defensive input handling; SQL injection is the standard example the school notes use.
- Use the term exactly as the syllabus words it, then link it to the scenario in the question; the 2025 feedback repeatedly rewards using the stimulus.
- Answer the command word: outline gives main points only, explain gives a reason or cause, discuss gives both sides.
Related terms
Same group in the syllabus: Benefits of collaboration (secure development) · Benefits to an enterprise of secure development · Social, ethical and legal issues · Employment (impact) · Copyright · Intellectual property · Digital disruption · Programmed backup · Software development steps for secure code (order) · General Data Protection Regulation (GDPR)