Migrate all CRUD operations to PostgreSQL syntax with parameterized queries

[devin-ai-integration]

Migrate all CRUD operations to PostgreSQL syntax with parameterized queries

Summary

This PR completes Phase 3 of the MySQL to PostgreSQL migration by updating all five CRUD operations in app.js to use PostgreSQL-compatible SQL syntax. The changes include:

• Security Fix: Replaced string interpolation with parameterized queries in DELETE, EDIT, and UPDATE operations, fixing SQL injection vulnerabilities
• PostgreSQL Syntax: Changed from MySQL's ? placeholder to PostgreSQL's $1, $2, $3 positional parameters
• Explicit Column Specification: Changed INSERT INTO users SET ? to explicit column listing and UPDATE users SET ? to explicit column updates

Important Note: The existing db.js wrapper already handles PostgreSQL's result.rows format conversion (line 52), so the callback receives rows directly. No changes to result handling were needed in app.js.

Review & Testing Checklist for Human

• Verify SQL injection fixes: Confirm that DELETE, EDIT, and UPDATE operations no longer use string interpolation and properly use parameterized queries
• Test all 5 CRUD operations end-to-end with PostgreSQL database:
  • List all users (GET /)
  • Create a new user (POST /save)
  • Edit an existing user (GET /edit/:userId and POST /update)
  • Delete a user (GET /delete/:userId)
• Verify parameterized query syntax: Check that all positional parameters ($1, $2, $3, $4) are correctly ordered and match the array of values passed to db.query()

Test Results

All five CRUD operations were tested end-to-end with PostgreSQL and verified working:

1. GET / - List all users ✅

2. POST /save - Create new user ✅

3. GET /edit/:userId - View edit form ✅

4. POST /update - Update user ✅

5. GET /delete/:userId - Delete user ✅

Notes

• The db.js wrapper function already converts result.rows to rows for PostgreSQL (line 52), so no changes to result handling were needed in app.js
• To test with PostgreSQL, set DB_TYPE=postgres in .env and configure the PG_* environment variables
• Session: https://app.devin.ai/sessions/52ec312e49bc460bb627229abe16f1b4
• Requested by: Satwik Bebortha (@satwik-cog)

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring