Code Quality Checker

def p(d, t):
    r = []
    for i in d:
        if i['t'] == t:
            r.append(i)
    return r

def c(d):
    t = 0
    for i in d:
        t += i['p']
    return t

QUALITY REPORT
==============

Overall Score: 3.2/10 (Poor)

READABILITY: 2/10
- Issue: Single-letter variable names (d, t, r, i, p)
  Line 1: Function name 'p' is not descriptive
  Line 2: Variable 'r' should be 'results' or 'filtered_items'
  Recommendation: Use descriptive names like 'filter_by_type' instead of 'p'

- Issue: No docstrings or comments
  Line 1-6: Missing function documentation
  Recommendation: Add docstring explaining parameters and return value

MAINTAINABILITY: 3/10
- Cyclomatic Complexity: 2 (Acceptable)
- Code Duplication: 40% (High)
  Lines 1-6 and 8-12 have similar iteration patterns
  Recommendation: Extract common iteration logic

BEST PRACTICES: 4/10
- Issue: Not following PEP 8 naming conventions
  Functions should have descriptive snake_case names
  
- Issue: No type hints (Python 3.5+)
  Line 1: Add type hints for parameters and return value
  Recommendation: def filter_by_type(data: List[Dict], type_filter: str) -> List[Dict]:

PERFORMANCE: 6/10
- Issue: Multiple list iterations could be combined
  Recommendation: Use list comprehension for better performance

DOCUMENTATION: 1/10
- Missing: Function docstrings
- Missing: Parameter descriptions
- Missing: Return value documentation

SUGGESTED IMPROVEMENTS:
1. Rename 'p' to 'filter_items_by_type'
2. Rename 'c' to 'calculate_total_price'
3. Add type hints and docstrings
4. Use list comprehensions
5. Extract common patterns into helper functions

const express = require('express');
const app = express();

app.get('/user', (req, res) => {
    const userId = req.query.id;
    const query = "SELECT * FROM users WHERE id = " + userId;
    
    db.query(query, (err, results) => {
        if (err) {
            res.send(err.message);
        }
        res.json(results);
    });
});

const API_KEY = "sk_live_abc123xyz";

app.listen(3000);

QUALITY REPORT
==============

Overall Score: 2.8/10 (Critical Issues Found)

SECURITY: 1/10 (CRITICAL)
⚠️ CRITICAL: SQL Injection Vulnerability
  Line 6: Direct string concatenation with user input
  Risk: Attacker can execute arbitrary SQL commands
  Example Attack: ?id=1 OR 1=1 -- 
  FIX: Use parameterized queries
  
  Secure Alternative:
  const query = "SELECT * FROM users WHERE id = ?";
  db.query(query, [userId], callback);

⚠️ CRITICAL: Hardcoded API Key
  Line 15: API key exposed in source code
  Risk: Key will be committed to version control
  FIX: Use environment variables
  
  Secure Alternative:
  const API_KEY = process.env.API_KEY;

⚠️ HIGH: Error Message Exposure
  Line 10: Sending raw error messages to client
  Risk: Leaks internal system information
  FIX: Log errors server-side, send generic message to client

PERFORMANCE: 4/10
- Issue: No connection pooling visible
  Recommendation: Use connection pool for database queries
  
- Issue: No caching strategy
  Recommendation: Implement Redis caching for frequently accessed users

READABILITY: 5/10
- Issue: No input validation
  Line 5: userId not validated before use
  Recommendation: Validate and sanitize all user inputs

MAINTAINABILITY: 4/10
- Issue: No error handling for database connection
- Issue: Missing async/await pattern (callback hell risk)
  Recommendation: Use async/await with try-catch

BEST PRACTICES: 3/10
- Missing: Request rate limiting
- Missing: CORS configuration
- Missing: Helmet.js security headers
- Missing: Input validation middleware

CRITICAL ACTIONS REQUIRED:
1. FIX SQL INJECTION: Use parameterized queries immediately
2. REMOVE HARDCODED SECRETS: Move to environment variables
3. IMPLEMENT INPUT VALIDATION: Validate userId is numeric
4. ADD ERROR HANDLING: Don't expose internal errors
5. ADD SECURITY MIDDLEWARE: Helmet, rate limiting, CORS