Kecil, part 3 - database management

Part 3 only touches db.js. The goal is that the router never composes SQL; it calls a method and gets rows back.

Get

Filter a table by a column. Every link belonging to user 1 is getXbyY("link", "owner_id", 1).

getXbyY(X, Y, value, cb) {
  const query = `SELECT * FROM ${X} WHERE ${Y} = '${value}'`;
  this.con.query(query, cb);
}

Add

An object goes in, an INSERT comes out. A small formatter walks the object, quotes strings, leaves numbers and booleans bare, and builds the column and value lists in matching order.

Reading this back in 2026: string-interpolating values into SQL is the wrong instinct, and I would use parameterised queries today. The shape of the abstraction was right; the escaping was not.