Bind variables are placeholders for literal values in a Structured Query Language (SQL) query being sent to the database on a server. Source: KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of Computer Security, 2001, John Wiley & Sons, Page 47.

The lattice is a mechanism use to implement Mandatory Access Control (MAC)
Under Mandatory Access Control (MAC) you have:
Mandatory Access Control
Under-Non Discretionary Access Control (NDAC) you have:
Rule-Based Access Control
Role-Based Access Control
Under Discretionary Access Control (DAC) you have:
Discretionary Access Control
The Lattice Based Access Control is a type of access control used to implement other access
control method. A lattice is an ordered list of elements that has a least upper bound and a most
lower bound. The lattice can be used for MAC, DAC, Integrity level, File Permission, and more
For example in the case of MAC, if we look at common government classifications, we have the
following:
TOP SECRET
SECRET -----------------------I am the user at secret
CONFIDENTIAL
SENSITIVE BUT UNCLASSIFIED
UNCLASSIFIED
If you look at the diagram above where I am a user at SECRET it means that I can access
document at lower classification but not document at TOP SECRET. The lattice is a list of
ORDERED ELEMENT, in this case the ordered elements are classification levels. My least upper
bound is SECRET and my most lower bound is UNCLASSIFIED.
However the lattice could also be used for Integrity Levels such as:
VERY HIGH
HIGH
MEDIUM ----------I am a user, process, application at the medium level
LOW
VERY LOW
In the case of Integrity levels you have to think about TRUST. Of course if I take for example the
VISTA operating system which is based on Biba then Integrity Levels would be used. As a user
having access to the system I cannot tell a process running with administrative privilege what to
do. Else any users on the system could take control of the system by getting highly privilege
process to do things on their behalf. So no read down would be allowed in this case and this is an
example of the Biba model.
Last but not least the lattice could be use for file permissions:
RWX
RW ---------User at this level
R
If I am a user with READ and WRITE (RW) access privilege then I cannot execute the file because
I do not have execute permission which is the X under Linux and UNIX.
Many people confuse the Lattice Model and many books says MAC = LATTICE, however the
lattice can be use for other purposes.
There is also Role Based Access Control (RBAC) that exists out there. It COULD be used to
simulate MAC but it is not MAC as it does not make use of Label on objects indicating sensitivity
and categories. MAC also require a clearance that dominates the object.
You can get more info about RBAC at:http://csrc.nist.gov/groups/SNS/rbac/faq.html#03
Also note that many book uses the same acronym for Role Based Access Control and Rule Based
Access Control which is RBAC, this can be confusing.
The proper way of writing the acronym for Rule Based Access Control is RuBAC, unfortunately it
is not commonly used.
References:
There is a great article on technet that talks about the lattice in VISTA:
http://blogs.technet.com/b/steriley/archive/2006/07/21/442870aspx
also see:
KRUTZ, Ronald L. & VINES, Russel D., The CISSP Prep Guide: Mastering the Ten Domains of
Computer Security, John Wiley & Sons, 2001, Chapter 2: Access control systems (page 33).
and
http://www.microsoft-watch.com/content/vista/gaging_vistas_integrity.html

Data validation is a method used to prevent Structured Query Language (SQL) injection attacks, which are a type of web application attack that exploit the input fields of a web form to inject malicious SQL commands into the underlying database. Data validation involves checking the input data for any illegal or unexpected characters, such as quotes, semicolons, or keywords, and rejecting or sanitizing them before passing them to the database34. References: 3: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 6, page 6604: CISSP For Dummies, 7th Edition, Chapter 6, page 199.