api-filtering-sorting

Parse query parameters with bracket syntax like price[gte]=100 for operators and comma-separated values like sort=-price,name for sorting. Whitelist allowed fields, then build a query object passed to your database layer such as MongoDB's find and sort.

Iterate over req.query entries and match keys against a regex like /^(\w+)\[(\w+)\]$/ to extract the field and operator. Map the operator to a database operator such as $gte, and skip any field not in your allowed filters list.

Whitelist allowed filter and sort fields before building the query, validate input types per field, and coerce values to expected types like numbers or booleans. Never pass raw req.query objects directly to the database driver.

A practical set includes eq, ne, gt, gte, lt, lte, in, and like. These cover equality checks, numeric ranges, array membership, and substring matching, which handle most data grid and search endpoint requirements.

Filtering on unindexed columns forces full collection scans. Index frequently filtered and sorted columns, limit query complexity per request, and monitor query performance to catch slow patterns early.