How to Use AI to Write Code: The Prompt Engineering Guide for Devs

❌ "Write a function to validate user input"
✅ "Write a TypeScript function validateUserInput(input: unknown): 
   { valid: boolean; errors: string[] } that validates: 
   email format, password (min 8 chars, must include number), 
   and username (3-30 chars, alphanumeric only)"

❌ "Write a function to fetch user data from our API"
✅ "Write an async fetchUser(userId: string) function using axios.
   Handle: 404 (return null, don't throw), 401 (throw AuthError), 
   network failures (throw NetworkError with retry suggestion), 
   rate limiting (respect Retry-After header). 
   Include request timeout of 5000ms."

❌ "Write a database query to get all active users"
✅ "Write a Prisma query to get all active users. 
   Schema: users table with fields: id (uuid), email (string), 
   status (enum: ACTIVE | INACTIVE | SUSPENDED), createdAt.
   Include: only users where status = ACTIVE and createdAt > 30 days ago.
   Order by createdAt DESC. Limit 100.
   Use our existing db client pattern: import { db } from '@/lib/db'"

Write a [language] function [functionName]([param types]) that:

Primary behavior:

Input validation:

Error handling:

Performance requirements:

Code style:
- TypeScript with strict types

Example usage:
const result = await functionName(exampleInput);
// Expected: [expected output]

Write a TypeScript async function createShortUrl(
  userId: string, 
  originalUrl: string, 
  customSlug?: string
): Promise<{ id: string; shortUrl: string; slug: string }> that:

Primary behavior:
- Validates originalUrl is a valid URL (throw ValidationError if not)
- If customSlug provided: check it's not taken (case-insensitive), 
  throw SlugTakenError if taken
- If no customSlug: generate a random 6-char alphanumeric slug
- Insert into short_urls table
- Return the created record

Error handling:
- Invalid URL → throw new ValidationError('Invalid URL format')
- Slug taken → throw new SlugTakenError('This slug is already in use')
- DB error → throw new DatabaseError with the original error as cause

Using: Prisma with our db client from '@/lib/db'
Use crypto.randomBytes for slug generation (not Math.random)

Create a [React/Vue/etc] component [ComponentName] that:

Props interface:

Behavior:

Styling:

Performance:

Do NOT:
- Use class components
- Import unused dependencies
- Use inline styles except where necessary

Write a [Next.js/Express/FastAPI] API endpoint for [route]:

Method: [GET/POST/PUT/DELETE]
Path: [/api/resource/:id]

Request:
- Auth: [required/optional, type: JWT/session]
- Body: [schema if POST/PUT]
- Query params: [if GET]

Response:
- Success: [status code] + [response schema]
- Not found: 404 + { error: "..." }
- Unauthorized: 401 + { error: "..." }
- Validation error: 422 + { errors: [...] }

Middleware to apply:

Database: Using [ORM] with [database]

Debug this [language] code. Walk through it step by step.

The code:
[paste code]

The error:
[paste full error message and stack trace]

Expected behavior: [what should happen]
Actual behavior: [what actually happens]

What I've already tried:

Environment: [Node version, framework version, OS if relevant]

Instructions:
1. Trace through the code execution line by line
2. Identify where actual behavior diverges from expected
3. Explain the root cause (not just the symptom)
4. Provide the fix
5. Explain why the fix works

I have an intermittent bug that's hard to reproduce.

Symptoms: [describe the bug]
Frequency: [how often it happens]
Conditions when it appears: [specific circumstances]
Conditions when it doesn't appear: [what makes it work correctly]

Relevant code:
[paste code]

Suspected causes I've considered:

What are the possible root causes for this type of intermittent behavior? 
Rank them by likelihood given my description.
For the top 2-3 causes, describe how I can add logging to confirm which one it is.

This code is slow. Profile it analytically.

Code:
[paste code]

Performance data:
- Current execution time: [Xms or Xs]
- Input size when it becomes slow: [N items, MB data, etc.]
- Target execution time: [Yms]

Analyze:
1. What is the algorithmic complexity (Big O) of this code?
2. What are the most expensive operations?
3. What would be the performance at 10x, 100x current input size?
4. What are the highest-leverage optimizations (80/20 rule)?
5. Provide optimized version with explanation of changes

Review this code for security vulnerabilities.

For each vulnerability found:
- Severity: Critical / High / Medium / Low
- Type: [SQL injection / XSS / IDOR / etc.]
- Specific location in code (line number or code snippet)
- Explanation of the attack vector
- Secure fix with corrected code

Code being reviewed:
[paste code]

Context:
- This code handles: [user inputs / payments / authentication / etc.]
- User trust level: [authenticated users / anonymous / admin only]
- Data sensitivity: [PII / financial / general]

Review the architecture of this system.

[Describe or paste architecture / code structure]

Evaluate:
1. Scalability: Where will this break under 10x current load?
2. Single points of failure: What breaks if one component goes down?
3. Security boundaries: Where are potential unauthorized access points?
4. Maintainability: What will be hardest to change as requirements evolve?
5. Technical debt: What shortcuts will compound into major problems?

For each issue: describe the problem, the risk level, and a solution approach.
Don't soften the criticism — I need to know the real risks.

Write documentation for this [function/API/module]:

[paste code]

Include:
- Purpose: What does this do and why does it exist?
- Parameters: Name, type, description, required/optional, constraints
- Return value: Type and what it represents
- Errors thrown: When and why each error occurs
- Example: One realistic usage example with input and output
- Notes: Any non-obvious behavior, gotchas, or important limitations

Format: [JSDoc / TypeDoc / Google docstring / Markdown]
Audience: [Mid-level developers new to this codebase]