API yang baik memungkinkan client memfilter dan mengurutkan data via query parameters.

Filtering:

GET /products?category=electronics&min_price=100000&max_price=5000000

app.get("/products", (req, res) => {
  let sql = "SELECT * FROM products WHERE 1=1";
  const params = [];

  if (req.query.category) {
    sql += " AND category = ?";
    params.push(req.query.category);
  }
  if (req.query.min_price) {
    sql += " AND price >= ?";
    params.push(Number(req.query.min_price));
  }
  if (req.query.max_price) {
    sql += " AND price <= ?";
    params.push(Number(req.query.max_price));
  }

  const products = db.prepare(sql).all(...params);
  res.json({ data: products });
});

Sorting:

GET /products?sort=price&order=desc

const allowedSort = ["name", "price", "created_at"];
const sort = allowedSort.includes(req.query.sort) ? req.query.sort : "id";
const order = req.query.order === "desc" ? "DESC" : "ASC";
sql += ` ORDER BY ${sort} ${order}`;

Keamanan: Jangan langsung masukkan req.query.sort ke SQL — whitelist dulu!