What languages are primarily used for front end coding? - Answers JavaScript and HTML
Application architecture - Answers supporting infrastructure that enables the execution and use of
software applications
presentation layer - Answers provides that user interfaces and the look and feel of the application,
receives inputs, provides outputs. Classic app or web architecture, front event where users input and
get output
business layer - Answers applies business logic to user inputs and outputs. Where calculations and
data is pulled in
data layer - Answers manages storage of application related and user data, typically in a database.
Where data is connected to databases to pull data into objects and lists.
two tier architecture - Answers client and server model
three tier architecture - Answers client, middle, and server model
input risks - Answers SQL injection, Cross-site scripting, session hijacking
Benefits of application architecture - Answers - making changes or errors in one section does not
affect the other sections
- allows for validation to secure each section
- can test separate sections which is good for building
how to prevent some SQL injection - Answers input validation
Scripting languages - Answers runs sequentially / runs as it reads it. Ex. HTML, JavaScript
Complied language - Answers programming language, such as C and C++. You have to package it all
up before it will run
what does XSS stand for - Answers cross site scripting
what can XXS do - Answers - redirect to a page that looks like the page it should be but fake
- can run scripts that input things that it shouldn't
session hijacking (script injection) - Answers -hacker overwrites a sub/function return pointer (which
tells the computer where to return once the function/sub is complete)
-attacker can set the value to point an address of his/her choosing
-more likely with C, C++
-less likely with C#, Java, Perl
blacklist - Answers rejecting known bad data / characters. Not the best method cause you are
constrained only to what you know is bad
whitelist - Answers accepting only valid data
sanitize/constrain user inputs by: - Answers blacklist, whitelist, cleaning bad data
input validation controls - Answers - do not trust user inputs
- sanitize/constrain user inputs
-encrypt or mask user inputs
-boundary checks and input manipulation control
best way to constrain user inputs - Answers whitelist
completeness check - Answers verifies that all critical field data are entered. It checks for missing
data or blacks
Range check - Answers compares entered data to a predetermined acceptable upper and lower limit.
limit check - Answers compares entered data to a predetermined upper or lower limit
validity check - Answers compares entered data against pre-specified data stored within the
computer to determine its validity.
Reasonableness check - Answers verify whether the amount of a new transaction record appears
reasonable when compared to other elements associated with each item being processed
field or mode check - Answers verifies that the entered data type is the appropriate mode for a field
Internet-based scripting languages - Answers - DOM (document object model)
- HTML (hypertext markup language)
- CSS (cascading style sheets)
DOM (document object model) - Answers an API used to provide structure to internet-related (i.e.,
HTML, XML) markup language documents
HTML (hypertext markup language) - Answers the code that is used to structure a web page and its
content
CSS (cascading style sheets) - Answers code that is used to style or format HTML elements