Why security testing protects users in Testing Fundamentals - Automation Benefits in Action

Verify login form prevents SQL injection

Preconditions (1)

Step 1: Enter "admin' OR '1'='1" in the username field

Step 2: Enter any password in the password field

Step 3: Click the login button

✅ Expected Result: Login is rejected and an error message is displayed without exposing database errors

Automation Requirements - Selenium with Python

Assertions Needed:

Verify that the error message is displayed

Verify that the URL does not change to a logged-in page

Verify that no database error messages are shown on the page

Best Practices:

Use explicit waits to wait for elements

Use clear and maintainable locators (By.ID, By.NAME)

Use assertions that check visible text and URL

Handle exceptions gracefully

Automated Solution

Testing Fundamentals

from selenium import webdriver
from selenium.webdriver.common.by import By
from selenium.webdriver.support.ui import WebDriverWait
from selenium.webdriver.support import expected_conditions as EC
import unittest

class TestSQLInjection(unittest.TestCase):
    def setUp(self):
        self.driver = webdriver.Chrome()
        self.driver.get('https://example.com/login')
        self.wait = WebDriverWait(self.driver, 10)

    def test_sql_injection_login(self):
        driver = self.driver
        wait = self.wait

        username_input = wait.until(EC.visibility_of_element_located((By.ID, 'username')))
        password_input = driver.find_element(By.ID, 'password')
        login_button = driver.find_element(By.ID, 'loginBtn')

        username_input.clear()
        username_input.send_keys("admin' OR '1'='1")
        password_input.clear()
        password_input.send_keys('anyPassword')
        login_button.click()

        # Wait for error message to appear
        error_message = wait.until(EC.visibility_of_element_located((By.ID, 'errorMsg')))

        # Assert error message is shown
        self.assertIn('Invalid username or password', error_message.text)

        # Assert URL did not change to dashboard
        self.assertNotIn('/dashboard', driver.current_url)

        # Assert no database error text is visible
        page_source = driver.page_source.lower()
        self.assertNotIn('sql syntax', page_source)
        self.assertNotIn('database error', page_source)

    def tearDown(self):
        self.driver.quit()

if __name__ == '__main__':
    unittest.main()

This test script uses Selenium with Python's unittest framework to automate the manual test case.

In setUp, it opens the browser and navigates to the login page.

The test test_sql_injection_login enters a common SQL injection string in the username field and any password, then clicks login.

It waits explicitly for the error message element to appear, then asserts the error message text is correct, ensuring the login was rejected.

It also checks the URL to confirm the user was not redirected to a logged-in page.

Finally, it checks the page source to ensure no database error messages are shown, which would be a security risk.

The tearDown method closes the browser after the test.

This structure follows best practices: explicit waits, clear locators by ID, and meaningful assertions.

Common Mistakes - 4 Pitfalls

Using time.sleep() instead of explicit waits

Using brittle XPath locators like absolute paths

Not checking that no database error messages appear

Not verifying the URL to confirm login failure

Bonus Challenge

Now add data-driven testing with 3 different SQL injection inputs to verify the login form rejects all.

Show Hint

Practice

1. Why is security testing important for software users?

easy

A. It makes the software run faster.

B. It helps protect user data from hackers.

C. It adds more features to the software.

D. It changes the software design.

Solution

1. Step 1: Understand the purpose of security testing

   Security testing checks for weaknesses that attackers could use to steal or damage user data.

2. Step 2: Identify the main benefit for users

   Protecting user data from hackers keeps users safe and their information private.

3. Final Answer:

   It helps protect user data from hackers. -> Option B

4. Quick Check:

   Security testing protects data = A [OK]

Hint: Security testing protects data, not speed or features [OK]

Common Mistakes:

• Confusing security testing with performance testing
• Thinking security testing adds features
• Believing it changes software design

2. Which of the following is the correct way to describe security testing?

easy

A. Testing software to find vulnerabilities attackers can exploit.

B. Checking software for bugs that slow it down.

C. Adding new user interface features.

D. Improving software documentation.

Solution

1. Step 1: Define security testing

   Security testing focuses on finding weak points or vulnerabilities in software that attackers might use.

2. Step 2: Match the correct description

   Only Testing software to find vulnerabilities attackers can exploit. correctly describes this focus on vulnerabilities and attacker risks.

3. Final Answer:

   Testing software to find vulnerabilities attackers can exploit. -> Option A

4. Quick Check:

   Security testing = find vulnerabilities [OK]

Hint: Security testing finds vulnerabilities, not bugs or features [OK]

Common Mistakes:

• Mixing security testing with performance or UI testing
• Thinking it improves documentation
• Confusing bugs with vulnerabilities

3. Consider this code snippet for a security test check:

def check_password_strength(password):
    if len(password) < 8:
        return False
    if not any(c.isdigit() for c in password):
        return False
    if not any(c.isalpha() for c in password):
        return False
    return True

print(check_password_strength('abc123'))
print(check_password_strength('abc12345'))

What will be the output?

medium

A. False\nFalse

B. True\nTrue

C. True\nFalse

D. False\nTrue

Solution

1. Step 1: Analyze first password 'abc123'

   Length is 6, which is less than 8, so returns False immediately.

2. Step 2: Analyze second password 'abc12345'

   Length is 8, contains digits and letters, so returns True.

3. Final Answer:

   False\nTrue -> Option D

4. Quick Check:

   Short password False, valid password True [OK]

Hint: Check length first, then digits and letters [OK]

Common Mistakes:

• Ignoring length check
• Assuming all passwords pass
• Confusing digit and letter checks

4. A security test script is supposed to check if user input is sanitized to prevent SQL injection. The code below is used:

def is_input_safe(user_input):
    if "'" in user_input or "--" in user_input:
        return False
    return True

print(is_input_safe("hello"))
print(is_input_safe("hello' OR 1=1 --"))

What is the problem with this test?

medium

A. It crashes on special characters.

B. It uses incorrect syntax for string checks.

C. It does not check for all SQL injection patterns.

D. It always returns True regardless of input.

Solution

1. Step 1: Understand the test logic

   The function checks only for single quote and double dash but SQL injection can use other patterns too.

2. Step 2: Identify limitation

   Because it only checks two patterns, it may miss other injection attempts, so test is incomplete.

3. Final Answer:

   It does not check for all SQL injection patterns. -> Option C

4. Quick Check:

   Partial pattern check = incomplete test [OK]

Hint: Check for multiple injection patterns, not just quotes [OK]

Common Mistakes:

• Thinking syntax is wrong
• Assuming it always returns True
• Believing it crashes on input

5. A company wants to protect user privacy by testing their app's data storage. Which approach best ensures security testing protects users?

hard

A. Regularly scan for vulnerabilities and fix data leaks promptly.

B. Add more user interface animations to distract attackers.

C. Only test security once before app launch.

D. Ignore security testing if no attacks happened yet.

Solution

1. Step 1: Identify best security testing practice

   Regular scanning finds new vulnerabilities as threats evolve, protecting user data continuously.

2. Step 2: Evaluate other options

   Adding animations, testing once, or ignoring security do not protect users effectively.

3. Final Answer:

   Regularly scan for vulnerabilities and fix data leaks promptly. -> Option A

4. Quick Check:

   Continuous testing protects users best [OK]

Hint: Security needs ongoing checks, not one-time or ignoring [OK]

Common Mistakes:

• Thinking security is a one-time task
• Confusing UI features with security
• Ignoring risks until attack happens