Lesson 4: Server-Side Scripting and Backend Integration

Every integrated application has a server side: code that runs on a machine you control, sits between users and your data, and talks to other systems. While the browser or mobile app (the client side) handles display and input, the server side enforces rules, hides secrets, and coordinates integrations. Why can the client not call a payment gateway directly? Because the gateway's secret API key must never ship inside an app where anyone can extract it. The server holds the key, receives the client's request, calls the gateway, and returns only safe results. Common server-side technologies you will meet: PHP (still powering a huge share of Philippine school and business websites), Node.js (JavaScript on the server), Python (Flask, Django, FastAPI), and Java (Spring). The concepts — routing, request handling, responses — are identical across all of them.

Server-side code is organized around routes: rules that map a method and URL pattern to a function. A handler for POST /enroll might: (1) read and validate the request body; (2) check business rules (is the subject open? does the student have unpaid balances?); (3) call other systems (registrar database, payment API); (4) return a JSON response with the right status code. Two universal rules: validate every input (never assume the client sent clean data — check types, ranges, and required fields) and fail with clear errors (return 400 with a message like "student_id is required", not a crash). Environment variables keep secrets (database passwords, API keys) out of source code — a favorite exam point and a real-world security requirement under the Data Privacy Act, since leaked credentials expose personal data.