Express - lesson 4 | HackIndia Skills

Key point

Three input places

Express gives you request data from three different places. Use req.params for path values, req.query for URL filters, and req.body for data sent in the request body.

Do not use old req.param(name). Express 5 removed it. Being explicit makes your API easier to review in a recruiter repo.

Params are path values

A param is part of the route path. Use it for required identity values, like a student ID, project ID, or internship application ID.

Example: GET /projects/42 should read 42 from req.params.projectId. Query strings do not decide which route matches.

Queries are filters

A query string starts after ?. Use it for optional choices like search, page, branch, year, or sort.

Example: GET /projects?branch=cse&year=3 should read branch and year from req.query. Treat query values as user input, not trusted data.

Common mistake

Body is not automatic

In Express 5, req.body can be undefined if no body parser has run. Do not assume it is an empty object.

For JSON APIs, add express.json() before the routes that need JSON. You can apply it app-wide for a small learning API, or only on routes that accept bodies.

Example

One projects route

This example reads all three places. It creates a project from the JSON body, uses the path param for the owner, and reads an optional query flag.

Keep validation simple here. Later lessons can improve errors and status codes.

import express from 'express';

const app = express();

app.use(express.json());

app.get('/projects/:projectId', (req, res) => {
  const { projectId } = req.params;
  const { includeTeam } = req.query;

  res.json({
    projectId,
    includeTeam: includeTeam === 'true'
  });
});

app.post('/students/:studentId/projects', (req, res) => {
  const { studentId } = req.params;
  const { title, repoUrl } = req.body ?? {};
  const { source } = req.query;

  res.json({
    message: 'Project received',
    studentId,
    source: source ?? 'direct',
    project: {
      title,
      repoUrl
    }
  });
});

app.listen(3000, () => {
  console.log('API running on http://localhost:3000');
});

Your to-do

Test with curl

Do each one yourself, then tap it to tick it off. The ticks are only a checklist for you: they are not marked or scored.

Start your server from the terminal.
Send a GET request with a route param and query string.
Send a POST request with a JSON body.
Check that each value appears in the response.
Change one value at a time to confirm where it comes from.

0 of 5 done

curl "http://localhost:3000/projects/42?includeTeam=true"

curl -X POST "http://localhost:3000/students/s101/projects?source=hackindia" \
  -H "Content-Type: application/json" \
  -d '{"title":"UPI Expense Tracker","repoUrl":"https://github.com/you/upi-expense-tracker"}'

Tip

Ask AI to inspect

Paste one route into ChatGPT, Gemini, or Claude and ask: “List every value this route reads from params, query, and body. Point out any missing parser or unsafe assumption.”

Check the answer. AI may suggest old Express patterns from older tutorials. Reject req.param(name), res.json(obj, status), and code that assumes req.body always exists.