Backend Queries

SQL injection prevention relies on parameterized statements, which separate query logic from user input. Use placeholders (?) or named parameters (:name) instead of string concatenation, ensuring the database engine treats input as data, not executable code. This applies across raw SQL, ORMs, and query builders.

N+1 queries occur when fetching a parent record triggers separate queries for each related child record. Eager loading—preloading related data in a single query—eliminates this. Use ORM methods like `.include()`, `.join()`, or `.fetch()` to load associations upfront, significantly reducing database round trips.

Query optimization combines indexing on frequently filtered columns, eager loading for relationships, efficient join patterns, and query timeouts to prevent runaway operations. Proper indexing on foreign keys and search fields accelerates filtering; caching and pagination reduce data transfer volume.

Transactions ensure atomic, consistent updates across multiple tables. They prevent partial failures where some records update while others fail, maintaining data integrity. Use transaction blocks to wrap dependent inserts, updates, or deletes so all succeed together or roll back completely.

Yes. Parameterized queries work across both raw SQL (using driver-level parameter binding) and ORM methods (which handle parameterization internally). Query builders and ORMs expose parameterized APIs by default; raw SQL requires explicit placeholder syntax like ? or :param depending on your database driver.

Index columns used frequently in WHERE clauses, JOIN conditions, and ORDER BY statements. Composite indexes on multiple columns support complex filters efficiently. Avoid over-indexing, which slows writes; prioritize columns that appear in slow queries or filter large result sets.