🧩 Legacy Code Explainer

Input — pasted code (a user-lookup helper)

const u = cache[id] || db.query("SELECT * FROM users WHERE id=" + id);
cache[id] = u;
return u;

Output — walkthrough + risks

Overview: a read-through cache around a user lookup — returns the cached row, otherwise hits the DB and memoizes the result.

• SQL injection — id is concatenated into the query string. Use a parameterized query instead.
• Caches failures forever — if db.query returns a rejected promise it's stored in cache[id]; nothing evicts entries (unbounded memory).
• Missing await — if db.query is async, u is a promise, not a row, so callers may break.