Databases and persistent data

Why persist data?

A backend keeps working data in memory while it runs, but memory is wiped whenever the server restarts or crashes. Applications also run on several servers at once, each with its own memory. To keep data safe, shared and searchable, applications store it in a database: software designed to save, organise and retrieve data reliably.

Data that survives restarts is called persistent data. User accounts, orders, course progress and messages are all persistent.

Relational databases

A relational database (PostgreSQL, MySQL, Oracle, SQL Server) stores data in tables with fixed columns, much like spreadsheets with strict rules:

Tables are linked with keys, and you query them with SQL (Structured Query Language):

SELECT name, email
FROM students
WHERE id = 2;

Relational databases enforce structure and constraints (for example, every email must be unique) and support transactions: a group of changes that either all succeed or all fail. That is essential for money transfers or seat bookings.

Document databases

A document database (MongoDB, Firestore) stores flexible JSON-like documents:

{
  "_id": "s2",
  "name": "Asha Menon",
  "email": "asha@example.com",
  "skills": ["HTML", "CSS"]
}

Documents can vary in shape, which is convenient for rapidly changing data. Both kinds of database are widely used; the Database Fundamentals path teaches SQL in depth.

How a backend talks to a database

The frontend never connects to the database directly. The backend receives a request, runs a query and returns the result:

Here is a small Node.js and Express endpoint using the pg PostgreSQL library:

app.get("/api/students/:id", async (req, res) => {
  const result = await pool.query(
    "SELECT id, name, email FROM students WHERE id = $1",
    [req.params.id],
  );
  if (result.rows.length === 0) {
    return res.status(404).json({ message: "Student not found" });
  }
  res.json(result.rows[0]);
});

Notice the $1 placeholder. The id from the URL is passed separately from the SQL text, so a malicious value cannot change the query. Building SQL by joining strings with user input creates SQL injection vulnerabilities, one of the most common security flaws.