What are the three ways a command's result is used?

A command can be executed to return a set of rows, to return a single value such as a count, or to return only the number of rows it affected, which is what an insert, update or delete reports.

What is a parameter in a data command?

A parameter is a named placeholder in the statement whose value is supplied separately, so the statement's structure is fixed before any user input is attached to it.

Write a parameterised statement that finds a member by surname.

The command text is SELECT MemberNo, Surname FROM Member WHERE Surname = @surname; and the value typed by the user is assigned to the parameter @surname before the command is executed.

Give an example of what string concatenation allows an attacker to do.

If a surname is pasted straight into a WHERE clause, entering a value that closes the quote and adds OR 1=1 makes the condition true for every row, so a search returns the whole table.

CCEA A-Level Software Systems Development CL4

Software and the Development Environment

Topic overview Systems software and application software The operating system and file management Source code files Binary, object and executable files Compilers, interpreters and the build process XML files and structured data Utility software and managing files on disk The integrated development environment Object oriented development platforms Open source software and licensing

Defining Data: Types, Variables and Classes

Topic overview Primitive types and their storage Reference types, objects and null Declaring variables, scope and lifetime Type casting and conversion Arithmetic operators and expressions Relational and logical operators Operator precedence and evaluation order Objects as occurrences of a class Abstract, base and inherited classes Attributes and the properties of a class Static variables in a class Interfaces and class reusability

Program Control Structures

Topic overview Sequence and the order of execution Methods and passing control between them Selection with IF and IF ELSE Nested IF and multi-way selection The switch statement Count-controlled repetition with FOR Conditional repetition with WHILE and DO WHILE Nested loops and tracing iterations Breaking out of loops and avoiding infinite loops Choosing and evaluating control structures

Objects, Classes and Data Structures

Topic overview Constructors and creating objects Methods, parameters and return values Encapsulation and access modifiers Getters, setters and validating an object's state Inheritance and the base class Overriding methods and run-time polymorphism Overloading methods Choosing and organising data structures Strings and string handling Static arrays of simple types Arrays of objects

Exception Handling and Managing Input and Output

Topic overview Why errors have to be trapped Types of error and how an exception is raised The try and catch block Catching more than one kind of exception The finally block and releasing resources Throwing exceptions and writing an exception class Checked and unchecked exceptions Reading and validating input from the command line Controlling screen output Text files Binary files Object files and serialisation

Testing an Object Oriented Application

Topic overview Why an object oriented application must be tested Choosing test data: normal, boundary and erroneous Writing a test plan for a class Testing a class method by method Testing constructors and object state Testing inheritance and overridden methods Testing error handling paths Dry runs and trace tables Test harnesses, drivers and stubs Recording and interpreting test results Evaluating a test plan and re-testing

Graphical User Interface Objects and Events

Topic overview Graphical user interfaces and console programs Forms and their common properties Labels, text boxes and text areas Buttons, check boxes and radio buttons Lists, combo boxes and other selection controls Properties, methods and events of a GUI object Containers, panels and laying out a form The event loop and the event queue Event handlers and registering a listener The event object and reading it inside a handler Button, mouse and keyboard triggers

Multiple Forms and Linking to Files

Topic overview Why an application needs more than one form Creating, showing, hiding and closing a form Modal and modeless forms Passing data between forms Menus, menu items and shortcuts Toolbars and navigation buttons Designing navigation for a multi form application Reading and writing text files Binary files and streams Object serialisation and object files Choosing between text, binary and object files

Designing, Testing and Evaluating an Event Driven Application

Topic overview Storyboards and what they show Building a storyboard from user requirements Prototyping and refining a design Error trapping in an event driven application Using try and catch inside an event handler Validating what a user types into a control Designing a test strategy for an event driven application Test plans and choosing test data Testing the paths a user takes through an interface Documenting and interpreting test results Evaluating an application against its requirements Evaluating features, functionality and usability

Reasons for Systems Development and Systems Methodologies

Topic overview Why organisations initiate systems development Analysis and design principles for business solutions Roles in development and the place of the user The purpose of a methodology and how methodologies evolved The waterfall model Iterative, incremental and spiral development Rapid application development The dynamic systems development method Scrum Extreme programming Prototyping in the development process UML modelling and simple diagrams

Managing Projects

Topic overview The purpose of project management Project management concepts and the project life cycle Roles and responsibilities in project management Resources needed to develop a project Estimating effort, duration and cost Gantt charts and the schedule Milestones and checkpoints Network diagrams and PERT Finding the critical path Float and how it is used Monitoring and controlling progress Managing risk and change

Testing Strategies

Topic overview Why testing matters throughout the development cycle Testing at the design stage Program and unit testing Integration testing System testing White box testing Black box testing Normal, boundary and erroneous test data User acceptance, alpha and beta testing The personnel involved in testing What a test plan contains Building a test plan for a scenario

Database Concepts and Entity Relationship Modelling

Topic overview What a database is and why one is used Database terminology: fields, records and keys The relational model The hierarchical model The network model Entities and attributes in an ER model Relationships and their degree Building an ER model for a problem From ER model to a working design Comparing the three database models

Normalisation and Structured Query Language

Topic overview Why data is normalised Un-normalised data and repeating groups First normal form Second normal form Third normal form Working a full normalisation through The advantages and limits of normalisation The principles of SQL SQL commands for defining and changing data SQL statements for retrieving data Joining tables and grouping results

Project Management and the Systems Approach in Practice

Topic overview Breaking a development into tasks and deliverables Estimating durations, effort and dependencies Documenting the plan as a Gantt chart Working out the critical path and float Milestones, reviews and user sign-off points Planning people, resources and skills Building a plan capable of reflecting change Recording progress against the plan Updating the plan to reflect slippage Recording change requests and versions of the plan Evaluating different approaches to a business problem Selecting and justifying a specific approach

Defining Requirements and Documenting the Design

Topic overview Eliciting requirements from the user Writing functional requirements Writing non-functional requirements Specifying the software and hardware the solution needs Producing and agreeing the user requirements specification Designing the data model and the tables Designing the inputs, the screens and the navigation Designing the outputs and the reports Documenting the processes and the logic of the solution Testing the design against the desired user outcomes Presenting the design and the solution using appropriate media

Building a Desktop Solution with a Database

Topic overview Applying relational techniques to a real solution Choosing the database and the development tool Connecting the application to the database Data adaptors Data sets Data commands and parameterised queries Binding the database to the interface Multiple forms and navigation Saving changes and protecting the data Testing and documenting the built solution

Testing and Evaluating the Solution

Topic overview Planning the testing of the finished solution Choosing test data: normal, boundary and erroneous Testing validation and error handling Testing the database and its queries Testing the user interface and the navigation Testing the whole solution and testing with the user Documenting test outcomes as evidence Diagnosing failures and retesting Evaluating the test procedures Evaluating the solution against the user requirements Evaluating delivery against the project plan Evaluating your own performance on the development

Building a Desktop Solution with a Database

Data commands and parameterised queries

3 things to know
A2 Unit 2

Overview

Data command, three ways a command's result is used and stored procedure.

What you need to know

Answer each one before you reveal it.

Your recallNot started

Key term

Why is a parameterised statement safer than building the statement by joining strings?

Key term

How are dates and numbers handled correctly by parameters?

Key term

What is a data command?

Questions from this subtopic

Each one with the model answer underneath.

1
What is a data command?
Model answer
A data command is a single SQL statement, or a call to a stored procedure, together with its parameters and the connection it runs on. It is the object an application uses to issue one instruction to the database.
2
What are the three ways a command's result is used?
Model answer
A command can be executed to return a set of rows, to return a single value such as a count, or to return only the number of rows it affected, which is what an insert, update or delete reports.
3
What is a parameter in a data command?
Model answer
A parameter is a named placeholder in the statement whose value is supplied separately, so the statement's structure is fixed before any user input is attached to it.
4
Write a parameterised statement that finds a member by surname.
Model answer
The command text is SELECT MemberNo, Surname FROM Member WHERE Surname = @surname; and the value typed by the user is assigned to the parameter @surname before the command is executed.
5
Why is a parameterised statement safer than building the statement by joining strings?
Model answer
With a parameter the structure of the statement is settled before the input arrives, so the input can only ever be a value. Joining strings lets input containing SQL change what the statement does.
6
Give an example of what string concatenation allows an attacker to do.
Model answer
If a surname is pasted straight into a WHERE clause, entering a value that closes the quote and adds OR 1=1 makes the condition true for every row, so a search returns the whole table.

See the rest and revise

Other ways to work this

The same content, four other ways.

What is inside Levo

Six ways to work the same material.

1Closed book

2Open book

3Closed book

The 3-step method, run for you

Answer cold, learn it, then prove it stuck. Levo tracks the jump between your first attempt and your last.

Software and the Development Environment

Defining Data: Types, Variables and Classes

Program Control Structures

Objects, Classes and Data Structures

Cram a whole paper in one sitting

Sort every topic into what you know and what you do not, then drill only the weak ones.

A null is the of one.

absencepresencetype

Blank Blitz makes facts automatic

Rapid timed gap-fills on the terms and numbers you need to recall without thinking.

AA null means no value has been recorded.

BZero and an empty string are values.

CA null is the absence of a value.

Build It gets the exam shape right

Assemble a full-mark answer from its marking points, in the order an examiner wants them.

An error is the mistake a person made.

TrueFalse

Test It catches misconceptions

Spot the fault in a statement. The traps are the mistakes students actually make.

721941163128510

Brain Breaks between sessions

Short focus games to reset attention, so the next set lands better than the last.

Every question in Building a Desktop Solution with a Database, on a schedule.

Attempt a question from memory, write the correct version, then attempt it again. Levo records the jump between your first attempt and your last, and brings each question back on the day you are due to forget it.

Start revising, £5 a month See how the method works

Or £46 a year, about £3.83 a month. Cancel anytime.