API yang nyata menyimpan dan mengambil data dari database, bukan hardcoded.

Pola umum: Route → Handler → Query → Response

app.get("/products", (req, res) => {
  // 1. Terima request
  const { category, sort } = req.query;

  // 2. Build query
  let sql = "SELECT * FROM products";
  const params = [];

  if (category) {
    sql += " WHERE category = ?";
    params.push(category);
  }

  if (sort === "price") {
    sql += " ORDER BY price ASC";
  }

  // 3. Execute query
  const products = db.prepare(sql).all(...params);

  // 4. Return response
  res.json({ data: products, total: products.length });
});

Parameterized queries (WAJIB):

// BAHAYA — SQL Injection
const sql = "SELECT * FROM users WHERE name = " + name;

// AMAN — Parameterized
const sql = "SELECT * FROM users WHERE name = ?";
db.prepare(sql).get(name);

Tips:

• Selalu gunakan ? placeholder untuk user input
• Return response yang konsisten { data: [...] }
• Tambahkan pagination untuk list endpoint
• Handle kasus "data tidak ditemukan" dengan 404