Connecting the app to the data
| English | Chinese | Pinyin |
|---|---|---|
| parameterised query | 参数化查询 | cān shù huà chá xún |
The two halves meet
- The browser asks for data. The server queries the database and sends the rows back as JSON.
- Nothing new happens here — it is the request-response loop of the first lesson, with SQL in the middle.
- What is new is the number of places a mistake can hide, so the discipline matters more than the code.
Parameterised, always
- The server takes the request, runs a parameterised query 参数化查询, and returns the result.
- The values travel separately from the query text, which is what makes injection impossible rather than unlikely.
- Never interpolate a value into SQL, no matter how harmless it looks or how sure you are of its source.
A value that came from your own dropdown menu is safe to concatenate into SQL.
The request can be sent without your menu. Parameterise everything, every time.
Handle the empty case
- A query that returns no rows is normal, not an error. A student with no enrolments, a search with no matches, a new account with no history.
- The page must say so — "no results" — rather than break, show a blank box, or display "undefined".
- ⚠ Testing only with data that exists is why the empty case reaches the marker rather than you.
A student exists but has no enrolments. What should the API return?
The student exists, so the request succeeded. 404 is for a student who does not exist.
Write the message a page should show when a search returns no results.
Example: "No courses match that search — try a shorter word or clear the filters."
One route, end to end.
The browser requests /api/students/17/courses. The server validates that 17 is an integer, runs a parameterised query joining enrolments to courses, and returns an array — possibly an empty one.
The page then renders the list, or the words "not enrolled in any courses yet".
Four steps, and the fourth is the one students skip. An empty array is a successful response, and treating it as a failure is a bug in the page, not in the data.
Put one API request in order.
The fourth step is the one students skip, and it is where the empty case reaches the marker.
A 200 with an empty list is success. Reserve 404 for a thing that does not exist — student 999 — and use an empty array for a thing that exists and has nothing. Confusing the two makes the client guess.
Why not send the whole table and filter it in the browser?
And it stops working as soon as the table is bigger than a demo. Filter in the query.
Do not send the whole table to the browser and filter it there. It is slow, it leaks every row you did not mean to show, and it stops working the moment the table is larger than a demo. Filter in the query.