CS13: Robust & Secure Programming
Validation, authentication, testing strategies, test data types, syntax vs logic errors, and debugging techniques for writing robust and secure programs.
✅ Validation
Validation is the process of checking that input data is reasonable, sensible, and within acceptable limits before it is processed. Validation does NOT check if data is accurate - only that it is acceptable.
| Check Type | Description | Example |
|---|---|---|
| Range check | Checks that a value is within a specified range | Age must be between 0 and 120 |
| Length check | Checks that a string has an acceptable number of characters | Password must be at least 8 characters |
| Type check | Checks that the data is of the correct data type | Age must be an integer, not a string |
| Presence check | Checks that a field has not been left empty | Name field cannot be blank |
| Format check | Checks that data follows a specific pattern | Email must contain @, date must be DD/MM/YYYY |
| Lookup check | Checks that a value exists in a predefined list | Country must be in the list of valid countries |
Validation in Pseudo-code
REPEAT
INPUT "Enter age (1-120): ", ageInput
age ← INT(ageInput)
IF age < 1 OR age > 120 THEN
OUTPUT "Age must be between 1 and 120"
ENDIF
UNTIL age >= 1 AND age <= 120
Validation vs Verification: Validation checks if data is reasonable. Verification checks if data is correct (e.g. double-entry where you type the data twice to confirm it). They are different processes!
🔐 Authentication
Authentication is the process of verifying a user's identity. The most common method is a username and password system. Authentication ensures that only authorised users can access a system.
Simple Authentication Pseudo-code
storedUsername ← "admin"
storedPassword ← "S3cur3!"
attempts ← 0
authenticated ← FALSE
WHILE attempts < 3 AND authenticated = FALSE
INPUT "Username: ", username
INPUT "Password: ", password
IF username = storedUsername AND password = storedPassword THEN
authenticated ← TRUE
OUTPUT "Access granted"
ELSE
attempts ← attempts + 1
OUTPUT "Invalid credentials. Attempts remaining: ", 3 - attempts
ENDIF
ENDWHILE
IF authenticated = FALSE THEN
OUTPUT "Account locked"
ENDIF
Additional Authentication Measures
- Lockout after failed attempts - prevents brute force attacks
- Password masking - shows *** instead of typed characters
- Two-factor authentication (2FA) - requires a second form of verification (e.g. code sent to phone)
- Strong password rules - minimum length, mix of characters
🧪 Testing Strategies
Testing is the process of running a program with various inputs to check it works correctly. Good testing uses a range of test data to find errors.
Types of Test Data
| Type | Description | Example (age 1-120) |
|---|---|---|
| Normal data | Typical, valid data that the program should accept | 25, 50, 80 |
| Boundary data | Data at the edge of valid ranges - the minimum and maximum acceptable values | 1, 120 (just within range) |
| Erroneous data | Data that is invalid and should be rejected | -5, 150, "hello" |
| Extreme data | Very large or very small valid data at the extremes of what is possible | 1, 120 (same as boundary in this case) |
Test Data for a Password (6-20 characters)
| Test Type | Test Data | Expected Result |
|---|---|---|
| Normal | "password1" (10 chars) | Accepted |
| Boundary | "abcdef" (6 chars) | Accepted (min length) |
| Boundary | "twentycharacterpw" (20 chars) | Accepted (max length) |
| Boundary | "abcde" (5 chars) | Rejected (one below min) |
| Erroneous | "" (empty string) | Rejected |
| Erroneous | "a"*21 (21 chars) | Rejected (over max) |
Exam Tip: Boundary data tests the exact limits. For a range of 1-100, boundary data is 1, 100, 0, and 101. The boundary values that are just outside the valid range are especially important.
🐛 Syntax vs Logic Errors
Syntax errors are mistakes in the grammar/rules of the programming language. The program cannot run at all. Logic errors are mistakes in the program's logic - the program runs but produces incorrect results.
| Feature | Syntax Error | Logic Error |
|---|---|---|
| What it is | Code that breaks the language rules | Code that runs but does the wrong thing |
| Does it run? | No - the program fails to compile/run | Yes - but produces wrong output |
| Detection | Found automatically by the translator/IDE | Found by testing with different inputs |
| Example | IF age > 18 THEN (missing ENDIF) | average ← total / 2 instead of / 3 |
| Fix | Correct the syntax rule violation | Trace through logic to find the mistake |
Syntax Error Examples
OUTPUT "Hello // Missing closing quote IF x > 5 // Missing THEN FOR i ← 1 TO 10 // Missing NEXT i score ← // Missing value after assignment
Logic Error Examples
// Wrong formula: area of rectangle should be length * width area ← length + width // Uses + instead of * // Off by one: should loop 10 times FOR i ← 0 TO 10 // Loops 11 times instead of 10 // Wrong comparison: should be <= IF score > 50 THEN // Should be >= for "pass at 50"
🔧 Debugging Techniques
Debugging is the process of finding and fixing errors in a program. Common techniques include using trace tables, adding output statements, using IDE debuggers, and dry running.
- Trace tables - step through the program line by line, recording variable values
- Output statements - add temporary OUTPUT commands to display variable values at key points
- IDE debugger - use breakpoints to pause execution and inspect variables
- Dry running - manually execute the code on paper with sample inputs
- Watch variables - monitor specific variables to see when they change unexpectedly
Debugging with Output Statements
// Bug: average is always wrong
total ← 0
FOR i ← 0 TO 4
INPUT score
total ← total + score
OUTPUT "DEBUG: total = ", total // Debug line
NEXT i
OUTPUT "DEBUG: final total = ", total // Debug line
average ← total / 5
OUTPUT "DEBUG: average = ", average // Debug line
OUTPUT "Average: ", average
⚠️ Common Mistakes
| Mistake | Why It's Wrong | How to Fix It |
|---|---|---|
| Confusing validation and verification | They are different processes | Validation = is it reasonable? Verification = is it correct? |
| Only testing with normal data | Errors often occur at boundaries | Always test with boundary and erroneous data |
| Saying extreme = erroneous | td>Extreme data IS valid (just very large/small), erroneous is NOT validExtreme data should be accepted; erroneous should be rejected | |
| Forgetting boundary-adjacent values | Both 1 and 0 for range 1-100 are boundary | Test just inside AND just outside the boundary |
❓ Practice Questions
Q1: Name three types of validation check and give an example of each.
Q2: A program asks for a test score between 0 and 100. Give examples of normal, boundary, and erroneous test data.
Q3: Explain the difference between a syntax error and a logic error.
Q4: Write pseudo-code that validates a username to be between 3 and 20 characters.
Q5: Describe two techniques for debugging a logic error.
✅ Answers
- Range check: age must be 0-120. Length check: password must be at least 8 characters. Type check: quantity must be an integer. Presence check: name cannot be empty. Format check: email must contain @.
- Normal: 75 (typical valid score). Boundary: 0, 100 (just within range), -1, 101 (just outside range). Erroneous: -50, 150, "hello" (clearly invalid).
- A syntax error is a mistake in the grammar of the programming language that prevents the program from running (e.g. missing ENDIF). A logic error is a mistake in the program's logic where it runs but produces incorrect results (e.g. dividing by the wrong number).
-
REPEAT INPUT "Enter username (3-20 chars): ", username IF LENGTH(username) < 3 OR LENGTH(username) > 20 THEN OUTPUT "Username must be between 3 and 20 characters" ENDIF UNTIL LENGTH(username) >= 3 AND LENGTH(username) <= 20 - 1) Use a trace table to step through the program line by line, recording variable values and comparing with expected values. 2) Add temporary OUTPUT statements at key points to display variable values and check if they match expectations.
🎯 Exam Tips
- Know all six validation types: range, length, type, presence, format, lookup
- Remember: validation checks if data is reasonable, verification checks if it is correct
- For test data, always provide normal, boundary, AND erroneous examples
- Boundary data includes values just inside AND just outside the valid range
- Syntax errors prevent running; logic errors allow running but produce wrong output
- When debugging, use trace tables and output statements to track variable values
⚠️ Common Errors
✗ Confusing validation and verification ✓ Validation checks if data is reasonable/acceptable (e.g. range checks); verification checks if data is correct by confirming it (e.g. double entry of passwords).
✗ Thinking validation guarantees data is correct ✓ Validation only checks that data meets rules (format, range, type); it cannot check if the data is factually correct. A valid age of 150 passes a type check but is wrong.
✗ Forgetting to validate BOTH input range and type ✓ Robust programs should check that input is the correct data type AND within an acceptable range. Type checking alone does not prevent unreasonable values.
✗ Believing authentication and authorisation are the same ✓ Authentication verifies WHO you are (e.g. username/password); authorisation determines WHAT you can access (e.g. admin vs standard user permissions).
✍️ Model Answer
Full-Mark Response
A program asks a user to enter their age (1-120). Describe three different validation checks that should be applied, and explain the difference between validation and verification. [5 marks]
Three validation checks: 1. Type check — ensure the input is an integer, not text or a decimal. 2. Range check — ensure the value is between 1 and 120 (inclusive). 3. Presence check — ensure the user has actually entered a value and not left it blank. Validation checks that data is reasonable and meets predefined rules (e.g. format, range, type). Verification checks that data entered is what the user intended, typically by asking them to enter it twice or showing a confirmation screen. Validation cannot guarantee accuracy — a user could enter 25 when their real age is 17, which passes validation but is incorrect.
📊 AO Deep Dive
Assessment Objective Analysis
AO1 (Computational Thinking — 40%): Demonstrate knowledge and understanding of the principles and concepts of computer science, including robust and secure programming: validation and verification for AQA 8525, OCR J277 & Edexcel 1CP2.
AO2 (Application — 40%): Apply knowledge and understanding of computer science, including robust and secure programming: validation and verification to analyse problems in computational terms and to design, write and evaluate solutions.
AO3 (Evaluation — 20%): Evaluate the effectiveness, correctness and efficiency of computational solutions, including robust and secure programming: validation and verification, and make reasoned judgements about trade-offs.
📝 Exam Technique
GCSE Computer Science Exam Tips:
Validation = is the data reasonable? (type check, range check, length check, presence check, format check, lookup check). Verification = is the data what was intended? (double entry, visual check). Authentication = who are you? Authorisation = what can you do? Always name the specific type of validation check, not just 'it checks the input'. Show validation code using WHILE loops with appropriate conditions.
Validation = is the data reasonable? (type check, range check, length check, presence check, format check, lookup check). Verification = is the data what was intended? (double entry, visual check). Authentication = who are you? Authorisation = what can you do? Always name the specific type of validation check, not just 'it checks the input'. Show validation code using WHILE loops with appropriate conditions.
📝 Exam Questions by Topic
🎬 Video Resources
Ready to ace your GCSE Computer Science exams?
Get the best revision books and guides to boost your grades.