Programming for the Web and Secure Software Systems
Web programming involves client-side (HTML, CSS, JavaScript) and server-side (e.g., PHP, Python, Node.js) technologies. Candidates must understand the request-response cycle, HTTP methods (GET, POST), and the role of cookies and sessions. Security is paramount: common threats include SQL injection, cross-site scripting (XSS), and cross-site request forgery (CSRF). Mitigations include input validation, parameterised queries, output encoding, and HTTPS. Traps include thinking client-side validation is sufficient (it can be bypassed; always validate server-side), or confusing authentication (verifying identity) with authorisation (granting permissions). Also, know that passwords must be hashed with salt, not stored in plain text. A worked example: a login form should use POST over HTTPS, validate inputs on both client and server, use parameterised queries to prevent SQL injection, and store password hashes using a strong algorithm like bcrypt. Rule of thumb: never trust user input; apply defence in depth. Also, be aware of the same-origin policy and how CORS works. Secure design includes least privilege and fail-safe defaults.