Review this admin query handler

app.post("/api/admin/search", async (req, res) => {
  const { collection, filter, sort } = req.body;

  const query = eval(`db.${collection}.find(${filter})${sort ? ".sort(" + sort + ")" : ""}`);
  const results = await query.toArray();

  res.json({ count: results.length, data: results });
});

app.get("/api/admin/stats", async (req, res) => {
  const stats = await db.collection("events").stats();
  res.json(stats);
});