📖 Topic Summary
Calling functions is fundamental to web development, but it's not always inherently "safe." Functions can introduce vulnerabilities if not handled carefully, especially when dealing with external data, user input, or modifying global states. Potential risks include security flaws like Cross-Site Scripting (XSS) or SQL Injection, unexpected side effects that alter application behavior, or performance bottlenecks. Understanding best practices—such as input validation, sanitization, error handling, and designing pure functions—is crucial for building secure, predictable, and maintainable web applications.
This worksheet will guide you through the core concepts and techniques to ensure your function calls contribute to a secure and robust web development environment rather than creating hidden dangers.
📚 Part A: Vocabulary
Match the following terms with their correct definitions. Write the letter of the definition next to the term.
- 1. 🔍 Input Validation
- 2. 🧼 Sanitization
- 3. ↔️ Side Effect
- 4. 🧪 Pure Function
- 5. 🚫 Cross-Site Scripting (XSS)
- ✍️ The process of cleaning user input to remove or neutralize malicious characters or code.
- 🚨 A type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users.
- 🌍 Any change of state or observable interaction with the outside world that occurs during the execution of a function, beyond returning a value.
- 📐 The process of ensuring that user input conforms to expected formats, types, and constraints before it is processed or stored.
- ♻️ A function that, given the same inputs, will always return the same output, and has no observable side effects.
✏️ Part B: Fill in the Blanks
Complete the following paragraph by filling in the blanks with the most appropriate terms from the list below:
(validation, sanitization, side effects, pure, least privilege, error handling)
To ensure function safety in web development, developers must implement robust ___________ for all user inputs, verifying data types and formats. Additionally, ___________ is crucial to remove any potentially malicious scripts or code before rendering content or storing data. Functions should ideally be ___________, meaning they produce the same output for the same input and avoid unnecessary ___________. Implementing strong ___________ mechanisms helps gracefully manage unexpected issues, preventing application crashes or exposure of sensitive information. Furthermore, adhering to the principle of ___________ ensures that functions only have access to the resources they absolutely need to perform their task.
🧠 Part C: Critical Thinking
- ❓ Explain why a developer might choose to use a "pure function" over a function with "side effects" when processing sensitive user data in a web application. Discuss the security and maintainability implications of this choice.