First, display user reviews on /item_view.

1. Update your "database" by adding lists of user reviews (name, comment) to each item
2. Update the item_view template to display that list as shown in the mockup

Next, create a POST route to handle adding new reviews.

1. Update the form to POST the new review data
2. Create a POST route to handle the request by adding the new review to the "database"
3. Send back item_view with the new review included

Finally, never, ever, ever trust data from the client! The client is in the hands of the enemy. You always need to see if the data is good (and safe!) before you do anything with it. In this exercise, we will ensure that the item id is valid, and neither the name or review text are blank.

1. Check the POST data to make sure the name and text are not blank
2. If either is blank, do not update the "database", send back item_view with one or more errors.
   • Have separate errors for "Name can't be blank" and "Review can't be blank"
   • Put the message(s) on the page as Bootstrap Alerts
3. If the item id is not a valid item, stop and res.sendStatus(404). That error can't be caused by normal user actions, so we don't want to give any feedback to a potential attacker.