Back-end programming
| English | Chinese | Pinyin |
|---|---|---|
| route | 路由 | lù yóu |
| validate input | 校验输入 | jiào yàn shū rù |
| status | 状态码 | zhuàng tài mǎ |
| SQL injection | SQL 注入 | SQL zhù rù |
| parameterised query | 参数化查询 | cān shù huà chá xún |
A URL is a promise about what happens next
- A route 路由 maps a URL to the code that runs when that URL is requested.
GET /coursesreturns a list;POST /enrolmentscreates one. The method is part of the meaning.- Keeping routes predictable is what makes an API usable by anyone who did not write it.
Validate on the server
- Validate input 校验输入 means checking that what arrived is what you can safely use: present, the right type, within range.
- Reject early and clearly. A request that cannot be honoured should say so rather than half-succeed.
- Return an honest status 状态码: 200 for success, 400 for a bad request, 404 for something that does not exist.
Match each status code to when you return it.
An honest status lets the client behave correctly without guessing from the body text.
SQL injection
- Never build a query by joining strings with user input. That is how SQL injection SQL 注入 happens.
- A field containing
'; DROP TABLE students; --becomes part of your query if you glued it in. - A parameterised query 参数化查询 sends the values separately from the query text, so input can never become instruction.
- ⚠ This is not an advanced topic. It is the single most common serious flaw in student web apps, and the fix is one line.
Which query is safe from SQL injection?
A parameterised query sends the value separately, so input can never become instruction.
In one sentence, explain what a parameterised query does differently.
Example: "It sends the value separately from the query text, so the database always treats it as data rather than as commands."
The same lookup, twice.
// Vulnerable: the input becomes part of the query
db.query("SELECT * FROM students WHERE name = '" + name + "'");
// Safe: the value travels separately
db.query("SELECT * FROM students WHERE name = ?", [name]);
The second is shorter, faster, and impossible to inject into. There is no situation in this module where the first is the right choice.
Which values must be treated as untrusted? Choose all that apply.
Everything that arrived from outside. The one attacker only needs you to have forgotten once.
Treat every value that came from outside as hostile until checked. Form fields, URL parameters, uploaded files, headers. Not because visitors are malicious, but because the one who is only needs you to have forgotten once.
Returning the database's error message helps the visitor fix their input.
It tells an attacker your table names and an ordinary visitor nothing useful. Log it; return a plain message.
Do not return a database error message to the browser. It tells an attacker your table names and structure, and it tells an ordinary visitor nothing they can act on. Log the detail; return a plain message.