Sanitize and validate user input at system boundaries — prevent XSS, SQL
94
89%
Does it follow best practices?
Impact
100%
1.20xAverage score across 6 eval scenarios
Passed
No known issues
A small e-commerce startup is building a product catalog service. Their backend team has a working database with a products table, but they need a REST API that lets the frontend filter products by name (partial text match), category, and price range. The team has been burned before by a security incident where user input made its way directly into database queries, so the new implementation must be done carefully.
The catalog currently stores thousands of items across categories like "electronics", "clothing", "food", and "books". The frontend needs to pass a search term to find products whose names contain a substring, optionally filter by category, and optionally filter by a minimum and maximum price. Individual products should also be retrievable by their numeric ID.
Build a Node.js (or Python) REST API with the following endpoints:
GET /api/products — returns a list of products, supporting query parameters:
search (string, optional) — filter products whose name contains this substringcategory (string, optional) — filter by exact category matchmin_price (number, optional) — minimum price (inclusive)max_price (number, optional) — maximum price (inclusive)GET /api/products/:id — returns a single product by its numeric IDUse an ORM of your choice (Prisma, Sequelize, SQLAlchemy, etc.) with an in-memory or file-based SQLite database so the API can be started and tested without any external services.
Produce:
README.md describing how to start the server and example requestsschema.sql or migration file showing the products table definitionThe API should start cleanly with npm install && npm start (or the Python equivalent) and return JSON responses.