Data Handling in Express.js

Data Handling is the fifth chapter of the free Express.js tutorial. It covers the data users send you, who they are, the files they share, and where you keep it all.

What each lesson covers:

  • Input Processing and Validation: Reading JSON, forms and headers, converting values, the Post-Redirect-Get pattern, validation middleware, 400 versus 422, and sanitizing input.
  • Cookies and Sessions: Setting and signing cookies, sessions with express-session, hashed passwords, login, protected routes, logout and session security.
  • File Handling: Sending files and downloads, streaming, uploads with Multer, checking uploads and preventing path traversal.
  • Working with a Database: SQLite with node:sqlite, safe parameters and SQL injection, CRUD routes, joins, transactions, repositories and migrations, and where PostgreSQL and ORMs fit.

Every lab runs a real Express 5 server in your browser. The lab's client keeps cookies like a browser, and the database labs run real SQLite.

Lessons in this section

  1. Input Processing and Validation

    Reading JSON, form data and headers, converting values, the Post-Redirect-Get pattern, validation rules, validation middleware, 400 versus 422, sanitization with trimming and allowlists, and validation libraries like Zod.

    • Read JSON, form data and headers safely
    • Convert strings to numbers, booleans and defaults
    • Use the Post-Redirect-Get pattern
    • Write reusable validation middleware
  2. Cookies and Sessions

    How cookies travel, setting, reading, signing and clearing cookies with cookie-parser, cookie options, sessions with express-session, session stores, login with hashed passwords, protecting page and API routes, logout, and session security.

    • Set, read, sign and clear cookies
    • Choose safe cookie options
    • Store per-visitor data with express-session
    • Build login, protected routes and logout
  3. File Handling

    Sending files with res.sendFile, downloads with res.download and res.attachment, streaming large files, uploads with Multer, memory and disk storage, checking uploads, path traversal and other file security, and upload error handling.

    • Send files safely with res.sendFile and the root option
    • Offer downloads with res.download
    • Stream large files
    • Accept uploads with Multer
  4. Working with a Database

    SQLite with node:sqlite, prepared statements and SQL injection, CRUD routes on a database, joins, transactions, repositories and migrations, and where PostgreSQL and ORMs fit.

    • Create tables and query them from Express
    • Use parameters to stop SQL injection
    • Build CRUD routes on a database
    • Join tables and use transactions