Back-end sub-system

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which part of a web system stores data in a database and applies business rules?

A The back-end

B The front-end

2. A student logs in to a school portal. Where is the password checked against the stored hash?

A In the user's browser (front-end)

B On the server (back-end)

3. True or false: the user can see the back-end code and database directly while using a website.

A False: the back-end is hidden from the user

B True: the back-end is visible in the browser

4. An online shop rejects an order because the quantity is more than the stock. What is this an example of?

A Business logic in the back-end

B Page layout in the front-end

5. Which is a back-end task?

A Changing a button's colour with CSS

B Saving a new order to the database

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1back-end		Aif not is_valid_token(token): return 401
2SELECT * FROM students WHERE studentId = 1		BA back-end database query that retrieves one student's stored record
3Business logic on the back-end applies the rules of the system before data is saved		CThe server side of a system that processes requests, applies business rules and stores data, hidden from the user
4A server-side security check verifies the user's login on the back-end instead of trusting the front-end		Dif quantity > stock: reject_order()
5Back-end code runs in the user's browser so the user can see and edit it		EThe back-end runs on the server and is hidden from the user. It is the front-end code that runs in the browser and can be seen.
6Only check the price in the front-end form. The back-end can trust it.		FThe back-end must never trust data from the front-end. It must run its own server-side checks because a user can change front-end data.

Definitions

back-end

Fill in the Blanks

Complete each line of code by filling in the missing parts.

@app._____("/login", methods=["POST"]) def login(): return check_user(request.form)

rows = db.execute("______ * FROM students")

if quantity _ stock: return "Out of stock"

if ___ user.is_logged_in: return "Access denied", 403

db.execute(sql, values) db.______()

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A def login(request):

B user = request.user

C pw = request.pw

D if check(user, pw) = True:

E return 'Welcome'

F return 'Denied'

Question 2

A def place_order(qty, stock):

B if qty < stock:

C return 'Not enough'

D return 'Order saved'

Question 3

A def save_score(db, mark):

B db.connect()

C db.insert(results, mark)

D db.close()

Question 4

A def get_grades(request):

B if request.logged_in:

C return 'Access denied'

D return grades(request.id)

Question 5

A def get_price(item_id):

B row = db.find(item_id)

C price = row['price'] + 1.1

D return price

Answer Key

Back-end sub-system

Section A: Quick Questions

A — The back-end

B — On the server (back-end)

A — False: the back-end is hidden from the user

A — Business logic in the back-end

B — Saving a new order to the database

Section B: Match the Pairs

back-end → The server side of a system that processes requests, applies business rules and stores data, hidden from the user

SELECT * FROM students WHERE studentId = 1 → A back-end database query that retrieves one student's stored record

Business logic on the back-end applies the rules of the system before data is saved → if quantity > stock: reject_order()

A server-side security check verifies the user's login on the back-end instead of trusting the front-end → if not is_valid_token(token): return 401

Back-end code runs in the user's browser so the user can see and edit it → The back-end runs on the server and is hidden from the user. It is the front-end code that runs in the browser and can be seen.

Only check the price in the front-end form. The back-end can trust it. → The back-end must never trust data from the front-end. It must run its own server-side checks because a user can change front-end data.

Section C: Definitions

back-end — The server side of a system that processes requests, applies business rules and stores data in databases, hidden from the user. The front-end displays results.

Section D: Fill in the Blanks

@app.route("/login", methods=["POST"])
def login():
    return check_user(request.form)

rows = db.execute("SELECT * FROM students")

if quantity > stock:
    return "Out of stock"

if not user.is_logged_in:
    return "Access denied", 403

db.execute(sql, values)
db.commit()

Section E: Spot the Error

D — A single = assigns a value, so it cannot be used in a condition. The back-end should test the password check with if check(user, pw): (or == True).

B — The business rule is to reject an order when the quantity is MORE than the stock. The condition should be if qty > stock:, otherwise valid orders are refused.

C — The table name is text, so it must be in quotes. Without quotes, Python looks for a variable called results. It should be db.insert('results', mark).

B — This server-side security check is reversed. It would deny logged-in users and let anonymous users through. It should be if not request.logged_in:.

C — The business logic adds 10% GST, which needs multiplication. Adding 1.1 only adds $1.10. It should be row['price'] * 1.1.