NodeJS/Express/socket.io backend

I have the backend of a socket.io script running in NodeJS for a web application. A user can login to the site and join a project collaboration (group of users linked to a project). Each project has a list containing multiple questions; each question contains multiple responses.

I've been writing the site such that each user associated to a project can see responses from other users in real time and without the need to refresh the page. This is mainly done to teach myself realtime development.

The script I have takes user input from their browser and depending on the action, queries a MySQL database - then sends an appropriate response.

The code is clearly messy and I want to refactor it and make it more readable. I've been reading Clean Code by Robert C Martin as was recommended to me. Where is the best place to start? I'm wondering if each socket.on response should be placed into a separate file? I am familiar with design patterns and algorithms but wonder how to apply these.

``
var express = require('express'),
http = require('http');
//make sure you keep this order
var app = express();
var server = http.createServer(app);
var io = require('socket.io').listen(server);
var mysql = require("mysql");
server.listen(3000, function() {
console.log('listening...');
});
var con = mysql.createConnection({
host: "localhost",
user: "david",
password: "access",
database: "AppTester"
});

var roomName;
io.on('connection', function(socket) {
console.log('connection...');
//var handshakeData = socket.request;
//console.log(handshakeData._query);
// var userID = handshakeData._query['userID'];
//var projectID = handshakeData._query['projectID'];
socket.on('userInfo', function(data) {
var query = 'SELECT ' +
' uc.ucIdCollaboration AS idCollaboration` ' +
' FROM ' + ' UserCollaboration uc ' +
' INNER JOIN ' + ' Collaboration c ' + ' ON ' +
' c.idCollaboration = uc.ucIdCol

A short review;

-
Your database related functions should be separated, in my mind your socket methods should only do this:

• Normalize parameters your receive like with isCheckedNum

• Call a method to Create/Read/Update/Delete data (with a promise mechanism)

• Emit to rooms if succesful and needed

• Send back the appropriate HTTP response code with extra info if needed

-
Use string interpolation: https://developer.mozilla.org/en/docs/Web/JavaScript/Reference/Template_literals

-
Introduce 'debug or log levels' in your code, so that you can call something like logEvent( data.testsheetType , 'DEBUG' ); This way it will only log data.testsheetType if you run in DEBUG mode to solve something. If you ran in production mode, then nothing would get logged. Basically point 4 of this article: https://blog.risingstack.com/node-js-logging-tutorial/

-
You should consider using a beautifier, your indentation is not consistent and makes the code harder to read. But also you put some newlines that don't seem right:

io.sockets.in(roomName).emit(
        'updateProjDesc', data);

-
Finally, obviously, in production code you would never ever put your credentials in the source code, that's just wrong.

StackExchange Code Review Q#162515, answer score: 3