Requirements Specification ¶

1 Overview ¶

This is an example of software requirements specification.

This is a regular paragraph in the document.

#		UL	DL	COV	DR
REQ-001	This is a first requirement (controlled paragraph with ID equal to "REQ-001").		ARCH-004	tp-001.2	ADR-001
REQ-002	This is a second requirement.		ARCH-005	tp-002.2

Controls in this section trace back to the records of the security risk register that motivate them.

#		UL	DL	COV	DR
REQ-010	The software shall pass every user-supplied value to the database exclusively as a bound parameter of a prepared statement.			tp-003.6	SECR-001
REQ-011	The software shall not compose any SQL statement text by concatenating or interpolating user-supplied input.				SECR-001

Note: verified by code review of the data layer rather than black-box testing.

#		UL	DL	COV	DR
REQ-012	When user input contains SQL metacharacters or injection payloads, the software shall treat the input as literal data and shall return only the results matching that literal value, without raising a database error.			4 tp-003.2 tp-003.3 tp-003.4 tp-003.5	SECR-001

Revision	Description of changes	Date
A	Initial version	2026-07-07