// ❌ BAD: SQL Injection vulnerability
const query = `SELECT * FROM users WHERE id = ${userId}`;

// ✅ GOOD: Parameterized query
const query = 'SELECT * FROM users WHERE id = $1';
await db.query(query, [userId]);

// ❌ BAD: Swallowing errors
try {
  await riskyOperation();
} catch (e) {}

// ✅ GOOD: Proper error handling
try {
  await riskyOperation();
} catch (error) {
  logger.error('Operation failed', { error, context });
  throw new AppError('OPERATION_FAILED', error);
}

// ❌ BAD: N+1 query problem
for (const user of users) {
  const orders = await db.query('SELECT * FROM orders WHERE user_id = $1', [user.id]);
}

// ✅ GOOD: Batch query
const userIds = users.map(u => u.id);
const orders = await db.query('SELECT * FROM orders WHERE user_id = ANY($1)', [userIds]);

## Code Review Report

### Critical Issues 🔴
1. **SQL Injection in UserService.ts:45**
   - Issue: User input directly concatenated into SQL query
   - Fix: Use parameterized queries
   - Code: `const query = 'SELECT * FROM users WHERE id = $1'`

### Warnings ⚠️
1. **Missing error handling in api/routes.ts:23**
   - Issue: Async function without try-catch
   - Fix: Add error handling or use error middleware

### Suggestions 💡
1. **Consider extracting magic number in utils.ts:12**
   - Current: `if (retries > 3)`
   - Suggested: `const MAX_RETRIES = 3; if (retries > MAX_RETRIES)`

### Summary
- Critical: 1
- Warnings: 2
- Suggestions: 5
- Overall Score: 7/10