Computing · Year 11 · Robust Programming Practices · Autumn Term

Introduction to Programming Paradigms

Students will explore different programming paradigms, including imperative, object-oriented, and event-driven programming, understanding their core principles.

• National Curriculum Attainment Targets
• GCSE: Computing - Programming
• GCSE: Computing - Software Development

About This Topic

Defensive design is the practice of writing code that anticipates and prevents errors before they occur. For Year 11 students, this means moving beyond simple functionality to focus on security and robustness. The curriculum covers input validation, sanitization, and authentication techniques that protect systems from accidental user error and malicious attacks like SQL injection. This topic is central to the 'Robust Programming' requirements of the GCSE standards.

Teaching defensive design helps students adopt a professional mindset toward software development. This topic comes alive when students take on the role of a 'hacker' in a controlled environment. By trying to break each other's code through unusual inputs, they quickly learn the necessity of strict validation and the limitations of a 'trusting' program.

Key Questions

1. Compare the benefits of object-oriented programming over imperative programming for large projects.
2. Explain how event-driven programming differs from traditional sequential execution.
3. Analyze a simple problem and determine which programming paradigm would be most suitable for its solution.

Learning Objectives

• Compare the core principles of imperative, object-oriented, and event-driven programming paradigms.
• Explain the advantages of object-oriented programming over imperative programming for managing complex software projects.
• Analyze a given problem scenario and justify the selection of the most appropriate programming paradigm for its solution.
• Demonstrate how event-driven programming responds to user interactions or system signals, contrasting it with sequential execution.

Before You Start

Introduction to Algorithms and Pseudocode

Why: Students need to be familiar with representing computational steps before exploring different paradigms for structuring those steps.

Basic Programming Constructs (Variables, Loops, Conditionals)

Why: Understanding fundamental programming elements is necessary to grasp how different paradigms utilize or abstract these concepts.

Key Vocabulary

Imperative Programming	A programming paradigm that describes computation in terms of statements that change a program's state. It focuses on how to achieve a result through a sequence of commands.
Object-Oriented Programming (OOP)	A programming paradigm based on the concept of 'objects', which can contain data in the form of fields (often known as attributes or properties) and code in the form of procedures (often known as methods).
Event-Driven Programming	A programming paradigm in which the flow of the program is determined by events, such as user actions (mouse clicks, key presses) or sensor outputs.
Sequential Execution	The standard flow of control in many programs where instructions are executed one after another in the order they appear.

Watch Out for These Misconceptions

Common Misconception

Validation and verification are the same thing.

What to Teach Instead

Students often use these terms interchangeably. Validation checks if data is sensible (e.g., age is a number), while verification checks if it's correct (e.g., is this actually the user's age?). Using a role-play where one person 'validates' a form and another 'verifies' it against an ID card helps clarify the difference.

Common Misconception

If I use a drop-down menu, I don't need to validate.

What to Teach Instead

Students think UI constraints prevent all bad data. However, hackers can bypass the UI to send data directly to the server. A collaborative investigation into 'inspect element' tools can show students how easy it is to bypass front-end restrictions.

Active Learning Ideas

Simulation Game: The Code Breaker

In pairs, one student acts as the 'developer' and the other as the 'malicious user'. The user tries to crash the developer's program using extreme values, wrong data types, or empty inputs, while the developer tries to patch the holes in real-time.

30 min·Pairs

Gallery Walk: Validation Critique

Post different snippets of validation code around the room (e.g., range checks, length checks, presence checks). Students move in groups to identify which specific errors each snippet prevents and which it might still let through.

20 min·Small Groups

Think-Pair-Share: UX vs Security

Students discuss the trade-offs between making a program easy to use and making it secure. For example, should a password require 20 characters and a biometric scan? They then share their 'balanced' security policy with the class.

15 min·Pairs

Real-World Connections

• Video game development heavily utilizes event-driven programming for handling player input, character actions, and in-game events, creating interactive experiences.
• Large-scale enterprise software, such as banking systems or customer relationship management (CRM) platforms, often benefits from object-oriented programming due to its ability to model complex real-world entities and relationships.

Assessment Ideas

Quick Check

Present students with three short code snippets, each representing a different paradigm (imperative, OOP, event-driven). Ask them to identify which paradigm each snippet exemplifies and briefly state one characteristic that led to their choice.

Discussion Prompt

Facilitate a class discussion using the prompt: 'Imagine you are building a simple calculator application versus a complex social media platform. Which programming paradigm would you choose for each, and why? Consider the benefits for code organization, reusability, and handling user interactions.'

Exit Ticket

Ask students to write down one key difference between imperative and event-driven programming. Then, have them describe a scenario where an object-oriented approach would be significantly more beneficial than an imperative one.

Frequently Asked Questions

What is the difference between input validation and sanitization?

Input validation checks if the data meets certain criteria (like being a number or within a range) and rejects it if it doesn't. Sanitization cleans the data by removing potentially harmful characters, such as SQL commands or HTML tags, before the program processes it.

Why is defensive design important for GCSE students?

It is a key requirement for the programming project and the theory exams. It teaches students to write 'robust' code that doesn't crash, which is a hallmark of a competent programmer. It also introduces them to the basics of cybersecurity.

How can active learning help teach defensive design?

Active learning, such as 'bug hunting' or 'adversarial testing' in pairs, makes the risks feel real. When a student successfully 'breaks' a peer's program, the need for validation becomes much more obvious than if they were just reading a list of validation types from a textbook.

What are common types of input validation?

Common types include range checks (is the number between 1 and 10?), length checks (is the password at least 8 characters?), presence checks (did they leave the field blank?), and format checks (does the email address have an @ symbol?).