| # | Requirements Specification | # | Test Step Description | Result |
| REQ-001 |
This is a first requirement (controlled paragraph with ID equal to "REQ-001"). |
tp-001.2 |
Some verification step for requirement "REQ-001" |
N/A |
| REQ-002 |
This is a second requirement. |
tp-002.2 |
Some verification step for requirement "REQ-002" |
N/A |
| REQ-010 |
The software shall pass every user-supplied value to the database exclusively as a bound parameter of a prepared statement. |
tp-003.6 |
Inspect the database query log for the searches of steps 2 to 5 and verify that each executed statement is a prepared statement with the search term bound as a parameter |
N/A |
| REQ-011 |
The software shall not compose any SQL statement text by concatenating or interpolating user-supplied input. |
|
|
|
| REQ-012 |
When user input contains SQL metacharacters or injection payloads, the software shall treat the input as literal data and shall return only the results matching that literal value, without raising a database error. |
tp-003.2 |
Search for the term "O'Brien" and verify that exactly the prepared record is returned and no database error is raised |
N/A |
| REQ-012 |
When user input contains SQL metacharacters or injection payloads, the software shall treat the input as literal data and shall return only the results matching that literal value, without raising a database error. |
tp-003.3 |
Search for the term "' OR '1'='1" and verify that no records are returned and no database error is raised |
N/A |
| REQ-012 |
When user input contains SQL metacharacters or injection payloads, the software shall treat the input as literal data and shall return only the results matching that literal value, without raising a database error. |
tp-003.4 |
Search for the term "'; DROP TABLE records;--" and verify that no records are returned, no database error is raised, and the records table still exists |
N/A |
| REQ-012 |
When user input contains SQL metacharacters or injection payloads, the software shall treat the input as literal data and shall return only the results matching that literal value, without raising a database error. |
tp-003.5 |
Search for the term "1 UNION SELECT username, password FROM users" and verify that no data from other tables appears in the results |
N/A |