SQL queries

SQL selects, filters, joins and aggregates rows. From Node you send parameterised queries, so values are never spliced into the query text. Reading the query plan tells you whether it is fast.

What a session covers

The tutor works through these with you, in conversation and code. A session ends when you have shown them, not when a video does.

Write a SELECT with a filter, a join and an aggregate
Send a parameterised query from Node
Spot the SQL injection in a concatenated query

In practice

A few lines that show SQL queries doing its job.

JavaScript

import postgres from "postgres";
const sql = postgres(process.env.DATABASE_URL);

const recent = await sql`
  SELECT o.id, o.total_cents, c.email
  FROM orders o
  JOIN customers c ON c.id = o.customer_id
  WHERE o.created_at > now() - interval '7 days'
    AND c.email = ${email}
  ORDER BY o.created_at DESC
  LIMIT 20`;

The common mistake

Watch for

Building a query with string concatenation and a user value. It is SQL injection: a crafted value changes the query. Always pass values as parameters.

How it stays learned

Once a session shows you understand SQL queries, it comes back for review. Each review takes a minute and tells the memory model how well you still know it.

Day 3First recall, while it is fresh
Day 7Second, a week on
Day 18Last, when it has settled

Where it leads

Topics that build on SQL queries.

Next in the moduleSchema design →