Step 7: Design the database

To go beyond a file, move the to-dos into a SQL database. Design the table first. A table needs a primary key, sensible types, and constraints that protect the data. Try the design below; it runs in your browser on a practice database, and each Run starts fresh.

The API's routes become queries: GET /todos is SELECT, POST is INSERT, PATCH is UPDATE ... WHERE id = ?, DELETE is DELETE ... WHERE id = ?. Always pass values as parameters (?), never by gluing strings together, to prevent SQL injection. The CHECK constraint repeats the title-length rule at the database level, a second safety net.