javascript 45 lines · 9 steps

Validating query params with Zod in Express

An Express route uses a Zod schema to coerce, validate, and default query parameters before building a safe database query.

Explained by highlit

Express Intermediate validation schema-parsing query-building coercion pagination

1const express = require('express');
2const { z } = require('zod');
3const router = express.Router();
4 
5const filterSchema = z.object({
6  status: z.enum(['active', 'archived', 'pending']).optional(),
7  minPrice: z.coerce.number().nonnegative().optional(),
8  maxPrice: z.coerce.number().positive().optional(),
9  tags: z
10    .string()
11    .transform((s) => s.split(',').map((t) => t.trim()).filter(Boolean))
12    .pipe(z.array(z.string()).max(10))
13    .optional(),
14  sort: z.enum(['created_at', 'price', 'name']).default('created_at'),
15  order: z.enum(['asc', 'desc']).default('desc'),
16  page: z.coerce.number().int().min(1).default(1),
17  limit: z.coerce.number().int().min(1).max(100).default(20),
18});
19 
20router.get('/products', async (req, res, next) => {
21  const parsed = filterSchema.safeParse(req.query);
22  if (!parsed.success) {
23    return res.status(400).json({ error: 'Invalid filters', details: parsed.error.flatten().fieldErrors });
24  }
25 
26  const { status, minPrice, maxPrice, tags, sort, order, page, limit } = parsed.data;
27 
28  let query = req.db('products');
29  if (status) query = query.where('status', status);
30  if (minPrice != null) query = query.where('price', '>=', minPrice);
31  if (maxPrice != null) query = query.where('price', '<=', maxPrice);
32  if (tags?.length) query = query.whereRaw('tags && ?', [tags]);
33 
34  try {
35    const rows = await query
36      .orderBy(sort, order)
37      .limit(limit)
38      .offset((page - 1) * limit);
39    res.json({ page, limit, data: rows });
40  } catch (err) {
41    next(err);
42  }
43});
44 
45module.exports = router;

01 / 01

STEP 01

Walkthrough

Space play ←→ step click any line

Three takeaways

1Coercing and defaulting query strings at the schema boundary keeps route logic clean and predictable.
2safeParse lets you reject bad input with structured errors instead of throwing mid-handler.
3Building queries conditionally from validated data avoids injecting untrusted values into the database.

Related explainers

javascript

import { useDeferredValue, useMemo, useState } from "react";
 
function ProductSearch({ products }) {
  const [query, setQuery] = useState("");

Keeping search input snappy with useDeferredValue in React

concurrent-rendering deferred-value memoization

Intermediate 7 steps

typescript

import { InjectionToken, inject, Provider, isDevMode } from '@angular/core';
import { WINDOW } from './window.token';
 
export interface AnalyticsConfig {

Layered config with an Angular InjectionToken

dependency-injection configuration factory-provider

Intermediate 8 steps

python

import re
from dataclasses import dataclass, field

Building a table of contents from Markdown

regular-expressions parsing slugification

Intermediate 9 steps

javascript

const IBAN_LENGTHS = {
  DE: 22, FR: 27, GB: 22, ES: 24, IT: 27,
  NL: 18, BE: 16, CH: 21, AT: 20, PT: 25,
};

How IBAN validation works in JavaScript

validation checksum modular-arithmetic

Intermediate 8 steps

javascript

class ToastQueue {
  constructor(container, { duration = 4000, max = 3 } = {}) {
    this.container = container;
    this.duration = duration;

Building a rate-limited toast queue

queue dom manipulation throttling

Intermediate 8 steps

func UploadDocument(c *gin.Context) {
	fileHeader, err := c.FormFile("file")
	if err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": "file is required"})