Defensive Design Considerations

Designing for what users might actually enter

A program should not depend on every user following its instructions perfectly. Someone might type letters where a number is expected, leave a required field blank or enter a value outside the permitted range. Misuse can be accidental, but it can also be deliberate: someone might try to gain access using another person's account or enter code intended to interfere with the program.

Defensive design means anticipating these possibilities and designing the program to handle them safely. This helps make a program robust: unexpected input should not cause it to crash or produce an inappropriate result.

Considering likely input values

Before writing an input routine, a programmer needs to decide what is acceptable and what should happen when something else is entered. Useful questions include:

• Must the user enter something, or can the field be blank?
• Is the input supposed to be text or a number?
• What values, lengths or formats are allowed?
• Could an unexpected entry disrupt processing or be an attempt at misuse?
• How will the program explain the problem and let the user try again?

For example, consider an age field that accepts whole numbers from 0 to 120 inclusive. The programmer must consider an ordinary value such as 16, the permitted limits 0 and 120, values outside those limits such as -1 and 121, text such as sixteen, and a blank entry. Checking only whether a number is below 121 would not deal with all these possibilities.

Input validation checks whether data meets the program's rules before it is used. Invalid data can be rejected with a useful error message and a request for another entry. A prompt helps the user understand what to enter, but it does not replace a check: users can still ignore or misunderstand it. The detailed validation routines are a separate part of defensive design.

Confirming a user's identity

Authentication checks whether a user is who they claim to be. In a simple login system, the username identifies the account being claimed and the password provides evidence that the user should be allowed to use it.

The program checks that the username exists and that the password is the one linked to that username. Both conditions must be satisfied before access is granted. A correct username alone is not enough, and a password belonging to a different account is not enough either.

Authentication and validation have different purposes. A password might meet a minimum-length rule and therefore pass that validation check, yet still fail authentication because it is not the account's password.

Building a simple authentication check

This Python example uses one demonstration account, with username learner and password Practice42. These fixed values make the comparison easy to follow; this is a learning example rather than a complete real-world login system.

username = input("Enter username: ")
password = input("Enter password: ")

if username == "learner" and password == "Practice42":
    print("Access granted")
else:
    print("Access denied")

Each input() stores the user's entry as text. The == operator compares that entry with the expected value. The and operator requires both comparisons to be true. If either comparison is false, the else branch denies access.

The expected behaviour is concrete:

These text comparisons are exact: changing the capitalisation or adding a space changes the entry. An unsuccessful attempt follows the denial branch rather than gaining access. In a larger program, the protected part of the program must only be reached after successful authentication; printing an access message alone does not protect it.