Interview Series — JavaScript Fundamentals for Test Automation Q1. What is the difference between slice() and substring() in JavaScript? Both slice() and substring() are used to extract part of a string. At first, they look l…

Sichere Programmierung dev.to 06.11.2025, 11:32 Uhr 3 Min. Lesezeit

↗ Quelle (dev.to)

Reagiere als Erste:r — dein Feedback zählt!

Interview Series — JavaScript Fundamentals for Test Automation

Q1. What is the difference between `slice()` and `substring()` in JavaScript?

Both slice() and substring() are used to extract part of a string. At first, they look like they work the same — but they behave differently when negative values or reversed start–end values are involved.

Let’s use one example string:

let str = "Playwright";

Basic Extraction

console.log(str.slice(0, 4));     // "Play"

console.log(str.substring(0, 4)); // "Play"

In normal cases, both give the same output.

Key Difference 1: Handling Negative Indices

console.log(str.slice(-5));       // "right"

console.log(str.substring(-5));   // "Playwright"

Behavior	Result
`slice(-5)` → Counts from end	✅ Returns `"right"`
`substring(-5)` → Converts `-5` to `0`	❌ Returns entire string

So:

slice() understands negative indexing

substring() ignores negative indexing

Key Difference 2: If Start > End

console.log(str.slice(5, 2));      // "" (empty string)

console.log(str.substring(5, 2));  // "ayw"

Method	Behavior
`slice()` returns empty when start > end	Keeps order exactly
`substring()` automatically swaps the values	Makes it work anyway

Comparison Table

Feature	`slice(start, end)`	`substring(start, end)`
Negative index support	✅ Yes (counts from end)	❌ No (converted to 0)
If start > end	❌ Returns empty	✅ Automatically swaps values
Works on	Strings + Arrays	Strings only
Best Use	Flexible slicing	Safe string extraction when values are uncertain

Internal Explanation (Simple Words)

slice() adjusts negative index by adding it to string length.

substring() treats any negative value as 0, and auto-reorders parameters.

This is why:

str.slice(-5) → last 5 chars  

str.substring(-5) → treats -5 as 0 → returns whole string

How to Answer in an Interview (Simple Version)

"slice() supports negative indexing and keeps start/end order.

substring() does not support negative indexing and swaps start and end if needed.

So slice() is more flexible, while substring() is safer for simple extractions."

Real QA Usage (Why Testers Should Know This)

When parsing API responses, log messages, or dynamic text:

Use slice() when taking values from end of string

Use substring() when taking values from beginning range safely

Example: Extract last 4 digits of an ID:

id.slice(-4);

What is the difference between slice() and splice()?

How is substr() different from slice()? Why is substr() deprecated?

How do you reverse a string without using built-in reverse() method?

How do you extract numbers from a string?

What happens if slice() receives floating number arguments?

Quick Summary (Easy to Remember)

Ask Yourself	Which One to Use
Need to slice from the end?	✅ Use `slice()`
Index values might be reversed?	✅ Use `substring()`
Working with arrays?	✅ Use `slice()`
Simple safe string cut?	✅ Use `substring()`

IR-PLAYBOOK-VULN-REMEDIATIONMEDIUM

Schritte anzeigen

SOC Incident Playbook: Vulnerability Remediation & Verification

Asset Inventory

Asset-Datenbank nach betroffenen Komponenten, Versionen und exposed Ports abfragen.

nmap -sV --script vuln -p- <target-network>

Exploit MonitoringSofort

SIEM-Regeln und IDS-Signaturen (Snort/Suricata) auf Angriffsversuche schärfen.

tail -f /var/log/suricata/fast.log | grep <cve>

Patch DeploymentSofort

Patch oder offiziellen Workaround gemäß Hersteller-Empfehlung einspielen.

Check Vendor Security Advisory Bulletin

1-Click Detection Engineering: Multi-Dialect SIEM Rules5 Formate

Regeln anzeigen

Syntax validiert (0 Fehler)

title: Detect Exploitation - Playwright Interview Questions and Answers (My Personal Experience)
id: 94ea14f5-ed2c-492e-a5e8-cafe98dcc90b
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-24
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access

Syntax validiert (0 Fehler)

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-24"
        description = "YARA Signature for "
    strings:
        $str = "Playwright Interview Questions" ascii wide
    condition:
        any of them
}

Syntax validiert (0 Fehler)

index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("Playwright Interview Questions and Answe")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

Syntax validiert (0 Fehler)

message: "*Playwright Interview Questions and Answe*"

Syntax validiert (0 Fehler)

CommonSecurityLog
| where Message has "Playwright Interview Questions and Answe"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

🎯

MITRE ATT&CK Matrix Navigator 14 Taktiken

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

💡 Tipp: Klicken Sie auf eine TTP, um Gegenmaßnahmen und SIEM-Erkennungsregeln anzuzeigen.Enterprise Matrix v14.1

🚀 Auf tsecurity.de entdecken

◀ VORHERIGER BEITRAG 5 Min

Serving an Astro Static Site with Brotli and Gzip on Nginx: A Complete, Practical Guide

Sichere Programmierung

NÄCHSTER BEITRAG 1 Min

Gaming in der Schweiz immer beliebter: 3,6 Mio zocken – vor allem auf dem Smartphone

IT NachrichtenWeiterlesen ▶

Blättern: Pfeiltasten [ ← ] [ → ] · Tasten j / k · mobil: Wischen

Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich Playwright Interview Questions and Answe.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen

1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.

🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC

Schnell-Prompts für Analysten

⚠️ DEFANGED SANDBOX VIEW (tsecurity.de): Alle Netzwerkindikatoren und URLs wurden neutralisiert (2 Indikatoren entschärft). Nur zur defensiven Analyse!

Format: python

#!/usr/bin/env python3
# Exploit Title: PoC for Target
import socket, sys
target = '192[.]168[.]1[.]10'
url = 'hxxp://target[.]local/vuln'
s = socket.socket()
s.connect((target, 80))
s.send(b'GET / HTTP/1.1\r\nHost: target.local\r\n\r\n')