If I query a database using complex SQL statements provided by the developer to retrieve data across multiple tables with an intention to confirm that a value was saved in database, is this considered white box testing or grey box testing?

Since I am using SQL statements that were programmed by the developer, does it seem like I am accessing database source code and therefore it is white box testing?

  • And what is the reason you're asking for this?
    – dzieciou
    Aug 2, 2016 at 3:12

4 Answers 4


In my opinion, we can use separate term for this activity -- database integrity testing (http://www.astqb.org/glossary/search/Database%20integrity%20testing). So, black box or white box categorization may not be applicable.

  • Thank you for your answer. This would be the best approach for the problem I am facing, to hire a database expert and to perform database integrity testing instead of an average QA Analyst attempting to access database with limited database knowledge. My manager is asking me to test database as part of gray box testing although I am not expert in testing databases.
    – Jul
    Aug 1, 2016 at 23:14
  • Thanks for accepting my answer. I am not familiar with your particular situation but I believe Qa analyst with sufficient knowledge of the system under test and sql can handle this task. So, hiring a database expert is a bit exaggerated IMHO. But let me point it again -- I'm not familiar with your particular situation.
    – olyv
    Aug 3, 2016 at 19:44

It's black box testing.

This is not Grey nor White box testing. Having a SQL query that is derived from a query within the source code does not make this Grey or White box testing. Also it likely is not helping your testing at all. All you are verifying is that the developer copied and slightly modified the query well.

If you want to do grey or white box testing, get the source code. Dig through the queries/stored procs/etc, monitor check ins and merges. It's not difficult and it will lead to the discovery of more interesting defects. Every Developer I have ever worked with has been more than happy to go over code and answer questions that I had regarding their check-ins. The fact that you are actively taking an interest in their work and want to make their lives easier with more detailed bug reports is a massive plus for them.

Will it help improve the quality of the project?

Honestly, probably not that much. I do find that it leads to better code being written due to the fact that the developers know that someone is paying attention.

  • Thanks for the answer. I have very good understanding of the internal system architecture, but I am not equipped for white box testing at all. I got this request from my manager to test database (as part of gray box testing) based on the SQL statements that developers would provide. Since this application has never been tested this way for the last 7 years, it made me wonder how sound this approach is.
    – Jul
    Aug 1, 2016 at 23:23

In general, we should not take test categorization too seriously.

Whether a test is of black, grey or white is opinion-based. The difference between black & grey, white & grey is much less obvious than the difference between black & white.

By definition,

  • black box testing involves NO source code; a tester knows nothing about source code. It normally involves end-user scenarios.
  • white box testing involves source code, everything is transparent, it does NOT involve end-user scenarios.
  • grey box testing is somewhere in between.

In your case, source code is involved so it has to be white or grey. Which test category it belongs to is based on "Do you consider your tests involve end-user scenario"?

You can argue it does involve end-user scenario as the data you are testing will likely to come from an end-user scenario (sampling testing some ordinary data.) and you can argue it does not involve end-user scenario as you can test data that is unlike to come from an end-user scenario (boundary testing some ridiculous data).

  • Thank you for your answer. The idea is to test end-user scenario and as part of expected result is to access database to confirm that data is stored correctly. I agree with you that since it is originated from end-user scenario, it would be gray box. I am also wondering how often this approach used in testing and what type of applications would benefit from it?
    – Jul
    Aug 1, 2016 at 23:10

With white box testing, you know exactly the internal implementation of your application. Tests are designed so that each path (or line of code) is executed at least once. It is usually employed to test applications where the expected level of reliability is high or when the safety of an individual is involved.

With grey box testing, you don't know the implementation, but you know the design or the data flow from the documentation which seems to be the case here.

So no, the test you are describing doesn't fall under white box testing and grey box testing would fit better.

Note that this test is an integration test and not an end to end test. Moreover, using a query provided by the developer kind of defeats the purpose of the test since the query you are getting is probably used by the application itself. So if it's defective (double records, different casing, improper encoding...), it will then make your test irrelevant.

  • Thank you for your answer. I was wondering myself how much value it would be in re-testing SQL statement provided by developer. It sounds like my concerns are valid as per your response.
    – Jul
    Aug 1, 2016 at 23:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.