29. Working with databases

Node talks to databases through driver libraries (`pg` for Postgres, `mysql2`, or ORMs like Prisma) that expose async, Promise-based query APIs backed by a connection pool — reusing a small set of open connections instead of opening one per request.

js
import { Pool } from "pg";
const pool = new Pool({ connectionString: process.env.DATABASE_URL });

async function getBalance(address) {
  const { rows } = await pool.query(
    "SELECT balance FROM accounts WHERE address = $1",
    [address], // parameterized — never string-concatenate user input into SQL
  );
  return rows[0]?.balance ?? "0";
}

Always use parameterized queries (placeholders like `$1` or `?`) instead of building SQL with template literals — string-concatenating user input directly into a query is the classic SQL injection vulnerability.

Read in another language

How to study this topic

Scoring

Check your understanding

Badges