Podcast
Questions and Answers
Which of the following is considered trusted data?
Which of the following is considered trusted data?
- Data that has passed through correct validation (correct)
- Data from an external database
- Form inputs from a web browser
- URL parameters
Which type of data is not trusted by a system?
Which type of data is not trusted by a system?
- Code that you have written directly into the program
- Data that has passed through correct validation
- Program code
- Anything from $_GET (correct)
What does input sanitisation primarily focus on?
What does input sanitisation primarily focus on?
- Validating the length of the input
- Ensuring the data is a valid email address
- Checking if the data is in the expected format
- Removing or escaping unwanted characters (correct)
What is the primary purpose of input validation?
What is the primary purpose of input validation?
What is a key characteristic of input validation?
What is a key characteristic of input validation?
Which of the following is a potential consequence of mixing untrusted data with SQL code?
Which of the following is a potential consequence of mixing untrusted data with SQL code?
Which of these is an example of untrusted data?
Which of these is an example of untrusted data?
What is the primary risk associated with using variables directly in SQL code?
What is the primary risk associated with using variables directly in SQL code?
What security vulnerability involves injecting malicious SQL code through user input?
What security vulnerability involves injecting malicious SQL code through user input?
Which action is characteristic of input sanitisation?
Which action is characteristic of input sanitisation?
What is the term for data originating from outside the system that is not trusted?
What is the term for data originating from outside the system that is not trusted?
What is the recommended approach to ensure SQL code safety?
What is the recommended approach to ensure SQL code safety?
Which of the following describes the main purpose of data filtering?
Which of the following describes the main purpose of data filtering?
Given that the user enters a phone number into a form that requires an email address, which security measure is designed to recognize this discrepancy and respond appropriately?
Given that the user enters a phone number into a form that requires an email address, which security measure is designed to recognize this discrepancy and respond appropriately?
If <> characters are converted into their corresponding HTML entity format, which type of security measure is being applied?
If <> characters are converted into their corresponding HTML entity format, which type of security measure is being applied?
For a login page with username: 'student', password: 'password', which of the following is untrusted?
For a login page with username: 'student', password: 'password', which of the following is untrusted?
In the context of web security, what does 'code injection' refer to?
In the context of web security, what does 'code injection' refer to?
Why is it necessary to differentiate between trusted and untrusted data?
Why is it necessary to differentiate between trusted and untrusted data?
Which of the following data filtering methods could lead to an error message if the incorrect data is entered?
Which of the following data filtering methods could lead to an error message if the incorrect data is entered?
Why should SQL code always consist of trusted data?
Why should SQL code always consist of trusted data?
What is the main difference between input sanitisation and input validation?
What is the main difference between input sanitisation and input validation?
In the context of web security, what is the purpose of escaping characters?
In the context of web security, what is the purpose of escaping characters?
What is the potential outcome of not validating user input in a web application?
What is the potential outcome of not validating user input in a web application?
Why is it important to sanitise data that will be displayed on a web page?
Why is it important to sanitise data that will be displayed on a web page?
Which of the following best describes the term 'untrusted data' in the context of web security?
Which of the following best describes the term 'untrusted data' in the context of web security?
How does using prepared statements help prevent SQL injection attacks?
How does using prepared statements help prevent SQL injection attacks?
What is the primary goal of a cross-site scripting (XSS) attack?
What is the primary goal of a cross-site scripting (XSS) attack?
Which of the following is a common technique for sanitising HTML input to prevent XSS attacks?
Which of the following is a common technique for sanitising HTML input to prevent XSS attacks?
What type of untrusted data is typically acquired via $_COOKIE?
What type of untrusted data is typically acquired via $_COOKIE?
In the context of web security, which type of attack involves injecting malicious code into a database query?
In the context of web security, which type of attack involves injecting malicious code into a database query?
Which of the following is a key aspect of secure coding practices to prevent web vulnerabilities?
Which of the following is a key aspect of secure coding practices to prevent web vulnerabilities?
What is the potential consequence of allowing users to upload arbitrary files to a web server without proper validation?
What is the potential consequence of allowing users to upload arbitrary files to a web server without proper validation?
In the context of web security, what is 'output encoding' primarily used for?
In the context of web security, what is 'output encoding' primarily used for?
Let's say a website requires users provide contact details; what potential security risk arises if a user enters JavaScript code into the 'Contact Name' form to trigger a popup?
Let's say a website requires users provide contact details; what potential security risk arises if a user enters JavaScript code into the 'Contact Name' form to trigger a popup?
What measure can be implemented to mitigate the risk of a user entering JavaScript code into a 'Contact Name' form?
What measure can be implemented to mitigate the risk of a user entering JavaScript code into a 'Contact Name' form?
Which of these is a tool or technique used to prevent SQL injection attacks?
Which of these is a tool or technique used to prevent SQL injection attacks?
What is a good way to ensure that the data stored in a database remains secure and not vulnerable to tampering?
What is a good way to ensure that the data stored in a database remains secure and not vulnerable to tampering?
To help improve web security, what is a good practice?
To help improve web security, what is a good practice?
What is the name of the process in which angle brackets (< and >) are encoded as HTML entities?
What is the name of the process in which angle brackets (< and >) are encoded as HTML entities?
Which of the following is a method of data filtering?
Which of the following is a method of data filtering?
What action could be described as input sanitisation?
What action could be described as input sanitisation?
Which of the following is an example of untrusted data?
Which of the following is an example of untrusted data?
What is the main purpose of input validation?
What is the main purpose of input validation?
Flashcards
Trusted Data
Trusted Data
Data that the system trusts, including program code and data that has passed through correct validation.
Untrusted Data
Untrusted Data
Data the system doesn't trust, including external data, web browser inputs, and data from $_GET, $_POST, or $_COOKIE.
Input Sanitisation
Input Sanitisation
Removing or escaping unwanted characters from input, often by quoting characters and HTML tags.
Input Validation
Input Validation
Signup and view all the flashcards
SQL Injection
SQL Injection
Signup and view all the flashcards
Study Notes
- Web security focuses on computer security issues within web development.
- SQL injection and cross-site scripting are code injection forms and common web vulnerabilities.
Trusted Data
- Data that the system trusts.
- Includes the program code itself.
- Includes data that has undergone correct validation.
Untrusted Data
- Data that the system does not trust.
- Includes data originating from outside the system.
- Includes data from external databases.
- Includes anything from a web browser, such as form inputs or URL parameters.
- Includes anything from $_GET, $_POST, or $_COOKIE.
Data Filtering: Input Sanitisation
- Removes or escapes unwanted characters.
- Usually involves quoting characters and HTML tags.
- Converts angle brackets into their HTML entity format for HTML.
- Does not verify if the data is correct.
- For email addresses, it removes inappropriate characters but does not check if the email is valid.
Data Filtering: Input Validation
- Checks user input to make sure it is formatted correctly and is of the expected type.
- Asks if the data being entered in the correct format
- Returns an error message if validation fails, does not alter the data.
SQL Injection
- Variables should not be directly inserted into SQL code, as SQL code should consist of trusted data only.
- Mixing variables in SQL code can introduce untrusted data.
Studying That Suits You
Use AI to generate personalized quizzes and flashcards to suit your learning preferences.
