Raw queries when needed in Express - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is a raw query in the context of Express and databases?

A raw query is a direct database command written in SQL or the database's native language, sent without using an ORM or query builder. It lets you run custom commands when needed.

beginner

Why might you use raw queries instead of ORM methods in Express?

You use raw queries when you need more control, complex queries, or better performance that ORM methods can't easily provide.

intermediate

How do you safely include user input in raw queries to avoid security risks?

You use parameterized queries or placeholders to safely insert user input, preventing SQL injection attacks.

intermediate

Show a simple example of a raw query using Express with a PostgreSQL client.

Example: client.query('SELECT * FROM users WHERE id = $1', [userId]) runs a raw SQL query with a parameter to safely get a user by id.

beginner

What is a risk of using raw queries without care in Express apps?

Using raw queries without parameterization can lead to SQL injection, where attackers can run harmful commands on your database.

What is the main reason to use raw queries in Express apps?

A To avoid writing any SQL code

B To run complex or custom database commands not supported by ORM

C To automatically sanitize all user inputs

D To speed up server startup time

Raw queries let you run complex or custom commands that ORM methods may not support.

Which method helps prevent SQL injection when using raw queries?

A Using parameterized queries or placeholders

B Writing queries as plain strings with user input directly

C Disabling database logging

D Using only GET requests

Parameterized queries safely insert user input, preventing SQL injection.

In Express, which package is commonly used to run raw SQL queries with PostgreSQL?

A body-parser

B express-session

C pg

D cors

The 'pg' package is the PostgreSQL client for Node.js and Express.

What is a downside of using raw queries too often in your Express app?

A They can make code harder to maintain and less portable

B They always run slower than ORM methods

C They automatically encrypt data

D They prevent database connections

Raw queries can be harder to read and maintain compared to ORM methods.

Which of these is NOT a good practice when using raw queries?

A Handling errors properly

B Using placeholders for user input

C Testing queries carefully

D Directly inserting user input into query strings

Directly inserting user input risks SQL injection and is unsafe.

Explain what raw queries are and when you might need to use them in an Express app.

Think about when ORM tools might not be enough.

Describe how to safely include user input in raw queries to avoid security problems.

Focus on how to keep your database safe.